Suspicious Child Process Of Wermgr.EXE

Title: Suspicious Child Process Of Wermgr.EXE
Status: test
Description:Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
References:
  -https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
  -https://www.echotrail.io/insights/search/wermgr.exe
  -https://github.com/binderlabs/DirCreate2System
Author: Florian Roth (Nextron Systems)
Date: 2022-10-14
modified:2024-08-29
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\wermgr.exe'
    Image|endswith:
      -'\cmd.exe'
      -'\cscript.exe'
      -'\ipconfig.exe'
      -'\mshta.exe'
      -'\net.exe'
      -'\net1.exe'
      -'\netstat.exe'
      -'\nslookup.exe'
      -'\powershell_ise.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\regsvr32.exe'
      -'\rundll32.exe'
      -'\systeminfo.exe'
      -'\whoami.exe'
      -'\wscript.exe'

  filter_main_rundll32:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains|all:
      -'C:\Windows\system32\WerConCpl.dll'
      -'LaunchErcApp '

    CommandLine|contains:
      -'-queuereporting'
      -'-responsepester'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high