Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects the execution of renamed 'cmd', 'powershell', or 'powershell_ise' binaries to 'wermgr.exe'. This technique has been observed in the exploitation of CVE-2023-36874, where attackers disguise legitimate system binaries to evade detection.