Techniques
Sample rules
Windows Error Report Created in ReportQueue Manually
- source: splunk
- technicques:
Description
The following analytic detects a .wer file being written into the Windows Error Reporting ReportQueue directory by a process other than the standard error-reporting binaries. Windows Error Reporting normally populates ReportQueue only through werfault.exe, werfaultsecure.exe, or wermgr.exe following an actual application crash. In the ShieldBreak exploit, the attacker fabricates a .wer report directly and manually invokes the QueueReporting scheduled task, which causes wermgr.exe to process the report and load an attacker-planted phantom DLL at SYSTEM integrity. If confirmed malicious, this activity indicates preparation for a local privilege escalation attempt abusing Windows Error Reporting.
Detection logic
`sysmon`
EventCode=11
action IN ("created","modified")
file_name="*.wer"
file_path="*\\ReportQueue\\*"
NOT process_path IN (
"*\\svchost.exe",
"*\\werfault.exe",
"*\\werfaultsecure.exe",
"*\\wermgr.exe"
)
| fillnull
| stats count min(_time) as firstTime
max(_time) as lastTime
by dest file_name file_path file_hash action
process_name process_path process_id user vendor_product
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_error_report_created_in_reportqueue_manually_filter`