LoFP LoFP / no false positives have been identified at this time. wermgr.exe spawning a system-integrity child process is not expected under normal windows error reporting operation.

Techniques

Sample rules

Windows Wermgr Spawning System Integrity Process

Description

The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level. WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children. In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell. If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.parent_process_name="WerMgr.exe"
(
    Processes.process_integrity_level="System"
    OR
    Processes.user IN ("*$", "System")
)

by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path
   Processes.parent_process Processes.parent_process_id Processes.process_name
   Processes.process_path Processes.process Processes.process_id Processes.process_hash
   Processes.process_integrity_level Processes.user Processes.vendor_product


| `drop_dm_object_name(Processes)`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_wermgr_spawning_system_integrity_process_filter`