Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Sigma