Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
2
1
1
1
Categories
4
1
1
Platforms
5
Products / Services
2
2
2
1
MITRE Techniques
4
4
1
1
1
CVEs
71
71
64
58
49
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Nightmare Eclipse (also known as Chaotic Eclipse) publicly released MiniPlasma, a zero-day local privilege escalation exploit granting SYSTEM-level access, exploiting a previously believed-patched flaw rooted in the Cloud Filter driver's HsmOsBlockPlaceholderAccess routine. As part of post-exploitation activity, the technique involves launching a process named wermgr.exe (Windows Error Reporting Manager) from a directory other than its legitimate system paths — a masquerading technique (T1036.005) used to blend in with normal Windows telemetry while evading naive name-based allowlisting. This detection identifies that specific anomaly: process creation events where the image name is wermgr.exe but the launch path falls outside System32, SysWOW64, WinSxS, servicing, or Windows Update staging directories. This rule should be paired with the registry IoC (symbolic-link creation under CloudFiles\BlockedApps) and scheduled-task abuse (QueueReporting) for full chain coverage, since the process-creation anomaly alone is a downstream artifact rather than the initial exploitation step.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects a write to windir under USER\.DEFAULT\Volatile Environment, the core primitive of CVE-2020-17103 (MiniPlasma). Writing windir here causes the WER QueueReporting scheduled task to execute wermgr.exe from an attacker-controlled path as SYSTEM instead of the legitimate C:\Windows\System32\wermgr.exe, achieving local privilege escalation. No legitimate software writes to this key.
