Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.