Name:Windows Wermgr Spawning System Integrity Process id:d39634c8-7ce7-4503-a5da-73ca3c758fb9 version:1 date:None author:Onur Mustafa Erdogan, Splunk status:production type:TTP Description:The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.
WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM. Data_source:
-Sysmon EventID 1
-Windows Event Log Security 4688
-CrowdStrike ProcessRollup2
search:| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
from datamodel=Endpoint.Processes where
Processes.parent_process_name="WerMgr.exe" ( Processes.process_integrity_level="System" OR Processes.user IN ("*$", "System") )
how_to_implement:This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe. known_false_positives:No false positives have been identified at this time.
WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation. References: -https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day -https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet -https://isc.sans.edu/diary/22536 drilldown_searches: name:'View the detection results for - "$dest$" and "$user$"' search:'%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$dest$" and "$user$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['RoguePlanet', 'Windows Privilege Escalation', 'Windows Error Reporting Service Elevation of Privilege Vulnerability']
