Windows WER Report.wer Creation in Uncommon ReportArchive Subfolders (Possible CVE-2023-36874 Activity)

title: Windows WER Report.wer Creation in Uncommon ReportArchive Subfolders (Possible CVE-2023-36874 Activity)
id: 9e2f4029-e1c7-4bbe-a077-07e10f270ed9
status: test
description: This rule flags creation of a Windows Error Reporting file named Report.wer under the ProgramData\Microsoft\Windows\WER\ReportArchive\ directory when it is placed in an uncommon subfolder. Attackers may abuse WER write locations to execute or stage activity associated with CVE-2023-36874, making unusual placement a useful indicator. The detection relies on Windows file event telemetry capturing the target file path.
references:
  - https://github.com/Wh04m1001/CVE-2023-36874
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_report_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-23
tags:
  - attack.execution
  - cve.2023-36874
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: :\ProgramData\Microsoft\Windows\WER\ReportArchive\
    TargetFilename|endswith: \Report.wer
  filter_main_locations:
    TargetFilename|contains:
      - \ReportArchive\AppCrash_
      - \ReportArchive\AppHang_
      - \ReportArchive\Critical_
      - \ReportArchive\Kernel_
      - \ReportArchive\NonCritical_
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 92389a99-5215-43b0-a09f-e334453b2ed3
    type: derived