Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
Detects the creation of a file named "wermgr.exe" in an uncommon directory, which could indicate exploitation of CVE-2023-36874. The rule specifically looks for 'wermgr.exe' being created outside of standard Windows system directories, aiming to catch malicious instances masquerading as the legitimate Windows Error Reporting Manager.
Sigma
