From 3d4978495e8c8a252aa6bf56a286ea56235bda8f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 24 Aug 2023 11:20:18 -0600
Subject: [PATCH 1/2] Windows Error Reporting Service Elevation of Privilege
 Vulnerability

---
 ...rocesses_run_from_unexpected_locations.yml |  1 +
 ...process_injection_wermgr_child_process.yml |  1 +
 ..._scheduled_task_created_to_spawn_shell.yml |  1 +
 ...e_elevation_of_privilege_vulnerability.yml | 22 +++++++++++++++++++
 4 files changed, 25 insertions(+)
 create mode 100644 stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml

diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index 9d85da7ce4..fe75a693bf 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -39,6 +39,7 @@ tags:
   - Ransomware
   - Masquerading - Rename System Utilities
   - Qakbot
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
   asset_type: Endpoint
   confidence: 50
   impact: 60
diff --git a/detections/endpoint/windows_process_injection_wermgr_child_process.yml b/detections/endpoint/windows_process_injection_wermgr_child_process.yml
index 0bb86de83d..2fe7f60bf4 100644
--- a/detections/endpoint/windows_process_injection_wermgr_child_process.yml
+++ b/detections/endpoint/windows_process_injection_wermgr_child_process.yml
@@ -32,6 +32,7 @@ references:
 tags:
   analytic_story:
   - Qakbot
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
   asset_type: Endpoint
   confidence: 70
   impact: 80
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 87713d65ec..d887cc8925 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -40,6 +40,7 @@ tags:
   - Ryuk Ransomware
   - CISA AA22-257A
   - Scheduled Tasks
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
   asset_type: Endpoint
   confidence: 100
   impact: 70
diff --git a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
new file mode 100644
index 0000000000..438072c072
--- /dev/null
+++ b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
@@ -0,0 +1,22 @@
+name: Windows Error Reporting Service Elevation of Privilege Vulnerability
+id: 64dea1e5-2c60-461f-b886-05580ed89b5c
+version: 1
+date: '2023-08-24'
+author: Michael Haag, Splunk
+description: In July 2023, CrowdStrike's Falcon Complete managed detection and response (MDR) team uncovered an exploit kit using an unknown vulnerability in the Windows Error Reporting (WER) component. The vulnerability, now identified as CVE-2023-36874, was also independently discovered by Google's Threat Analysis Group. The exploit came to light when suspicious binaries were observed on a European technology system. CrowdStrike's Counter Adversary Operations' analysis revealed a zero-day exploit targeting the WER service, allowing attackers to execute unauthorized code with elevated privileges. The exploit kit seen aimed to spawn a privileged interpreter, displaying the versatility and adaptability of the threat. CrowdStrike has listed some potential indicators of compromise, but these are of low fidelity due to their mutable nature.
+narrative: In June 2023, CrowdStrike's Falcon Complete team observed suspicious activities on a European technology entity's system. Multiple binaries were dropped onto the system via Remote Desktop Protocol (RDP), some of which were flagged as potential exploits for a known vulnerability. However, a string containing the Russian term for "0day" suggested an unknown vulnerability was at play. Subsequent investigations identified this as a zero-day vulnerability affecting the Windows Error Reporting (WER) component, now known as CVE-2023-36874. \
+
+  The WER service's function is to report software issues on Windows hosts. The exploit centered around manipulating the WER service by redirecting file systems to execute attacker-controlled code with elevated privileges. This was achieved by creating a symbolic link redirection from the C:\ drive to an attacker-controlled directory, and then triggering certain WER functions. Consequently, an unauthorized executable was run instead of the legitimate one, giving the attacker high-level access. \
+
+  The observed exploit kit's primary objective was to initiate a privileged interpreter, such as cmd.exe or powershell_ise.exe. If this couldn't be achieved, a privileged scheduled task was created as an alternative. The exploit kit showcased a range of binaries, some packed and others not, some in C++ and others in pure C. This diversity suggests the knowledge of the vulnerability was likely shared among different developers. \
+
+  CrowdStrike's Counter Adversary Operations, as of now, hasn't linked this activity to any specific threat actor. They've provided potential indicators of compromise, but caution that these are easily changed, indicating the advanced capabilities of the adversaries.
+references: []
+tags:
+  analytic_story: Windows Error Reporting Service Elevation of Privilege Vulnerability
+  category: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From fca9e54fe9b9f4dd68413c4affb40d6f882e7171 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 28 Aug 2023 13:01:22 -0600
Subject: [PATCH 2/2] Update
 windows_error_reporting_service_elevation_of_privilege_vulnerability.yml

---
 ...porting_service_elevation_of_privilege_vulnerability.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
index 438072c072..9b2a2ae8cb 100644
--- a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
+++ b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
@@ -11,10 +11,12 @@ narrative: In June 2023, CrowdStrike's Falcon Complete team observed suspicious
   The observed exploit kit's primary objective was to initiate a privileged interpreter, such as cmd.exe or powershell_ise.exe. If this couldn't be achieved, a privileged scheduled task was created as an alternative. The exploit kit showcased a range of binaries, some packed and others not, some in C++ and others in pure C. This diversity suggests the knowledge of the vulnerability was likely shared among different developers. \
 
   CrowdStrike's Counter Adversary Operations, as of now, hasn't linked this activity to any specific threat actor. They've provided potential indicators of compromise, but caution that these are easily changed, indicating the advanced capabilities of the adversaries.
-references: []
+references:
+- https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
 tags:
   analytic_story: Windows Error Reporting Service Elevation of Privilege Vulnerability
-  category: []
+  category:
+    - Adversary Tactics
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security