Techniques
Sample rules
Windows Wermgr Spawning System Integrity Process
- source: splunk
- technicques:
Description
The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level. WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children. In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell. If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes where
Processes.parent_process_name="WerMgr.exe"
(
Processes.process_integrity_level="System"
OR
Processes.user IN ("*$", "System")
)
by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path
Processes.parent_process Processes.parent_process_id Processes.process_name
Processes.process_path Processes.process Processes.process_id Processes.process_hash
Processes.process_integrity_level Processes.user Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_wermgr_spawning_system_integrity_process_filter`