Louis Schürmann
@plat00 followers11 downloads13 copies0 likes549 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
MITRE Techniques
1
1
1
CVEs
1
Detects a write to windir under USER\.DEFAULT\Volatile Environment, the core primitive of CVE-2020-17103 (MiniPlasma). Writing windir here causes the WER QueueReporting scheduled task to execute wermgr.exe from an attacker-controlled path as SYSTEM instead of the legitimate C:\Windows\System32\wermgr.exe, achieving local privilege escalation. No legitimate software writes to this key.
