Windows process execution: wermgr.exe running outside standard system directories

title: "Windows process execution: wermgr.exe running outside standard system directories"
id: c63b7aaa-86f8-4d3a-8294-f2d5e1c89288
related:
  - id: 396f6630-f3ac-44e3-bfc8-1b161bc00c4e
    type: similar
  - id: 5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5
    type: derived
status: test
description: This rule flags executions of wermgr.exe when the image path does not begin with typical Windows system locations. Attackers may abuse legitimate binaries by running them from unusual directories to evade basic allowlists. The detection relies on process creation telemetry, specifically the created process image path and its directory prefix.
references:
  - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
  - https://www.echotrail.io/insights/search/wermgr.exe
  - https://github.com/binderlabs/DirCreate2System
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-10-14
modified: 2023-08-23
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \wermgr.exe
  filter_main_legit_location:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1