Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise
Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-23
- Updated
- 2026-07-31
What it detects
This rule identifies process execution where the image filename ends with \wermgr.exe while the process reports an OriginalFileName of cmd.exe, powershell.exe, or powershell_ise.exe. This pattern is consistent with attackers renaming legitimate Windows binaries to masquerade as wermgr.exe during exploitation activity. Detection relies on Windows process creation telemetry that includes both the executable path/name and the OriginalFileName metadata.
Reporting behind it
- github.comhttps://github.com/Wh04m1001/CVE-2023-36874
- crowdstrike.comhttps://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/proc_creation_win_exploit_cve_2023_36874_fake_wermgr.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-execution-renamed-cmd-powershell-powershell-ise-as-wermgr-exe-50dbc08b
title: Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise
id: 2f15916b-dc2b-44bd-9cf2-42381f2b31a0
status: test
description: This rule identifies process execution where the image filename ends with \wermgr.exe while the process reports an OriginalFileName of cmd.exe, powershell.exe, or powershell_ise.exe. This pattern is consistent with attackers renaming legitimate Windows binaries to masquerade as wermgr.exe during exploitation activity. Detection relies on Windows process creation telemetry that includes both the executable path/name and the OriginalFileName metadata.
references:
- https://github.com/Wh04m1001/CVE-2023-36874
- https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/proc_creation_win_exploit_cve_2023_36874_fake_wermgr.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-23
tags:
- attack.execution
- cve.2023-36874
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName:
- Cmd.Exe
- powershell_ise.EXE
- powershell.exe
Image|endswith: \wermgr.exe
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 50dbc08b-60ce-40f1-a6b6-346497e34c88
type: derived