Windows: Report.wer File Created in Uncommon WER ReportArchive Subfolders
Alerts on Report.wer creation under WER ReportArchive paths that don’t match common subfolder patterns.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-23
- Updated
- 2026-07-31
What it detects
This rule flags creation of a Report.wer file located under the Windows Error Reporting (WER) ReportArchive path, specifically within a target folder structure that is not among common subfolder patterns. An attacker may drop or trigger WER-related artifacts to facilitate exploitation or post-exploitation activity. The detection relies on Windows file event telemetry capturing the full TargetFilename and matching its ending name plus the presence of the expected WER directory prefix.
Reporting behind it
- github.comhttps://github.com/Wh04m1001/CVE-2023-36874
- crowdstrike.comhttps://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_report_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-wer-report-wer-creation-in-uncommon-reportarchive-subfolders-possible-cv-92389a99
title: "Windows: Report.wer File Created in Uncommon WER ReportArchive Subfolders"
id: 9e2f4029-e1c7-4bbe-a077-07e10f270ed9
status: test
description: This rule flags creation of a Report.wer file located under the Windows Error Reporting (WER) ReportArchive path, specifically within a target folder structure that is not among common subfolder patterns. An attacker may drop or trigger WER-related artifacts to facilitate exploitation or post-exploitation activity. The detection relies on Windows file event telemetry capturing the full TargetFilename and matching its ending name plus the presence of the expected WER directory prefix.
references:
- https://github.com/Wh04m1001/CVE-2023-36874
- https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_report_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-23
tags:
- attack.execution
- cve.2023-36874
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: :\ProgramData\Microsoft\Windows\WER\ReportArchive\
TargetFilename|endswith: \Report.wer
filter_main_locations:
TargetFilename|contains:
- \ReportArchive\AppCrash_
- \ReportArchive\AppHang_
- \ReportArchive\Critical_
- \ReportArchive\Kernel_
- \ReportArchive\NonCritical_
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 92389a99-5215-43b0-a09f-e334453b2ed3
type: derived