kevmap

Coverage › CVE-2024-26169

CVE-2024-26169 Mapped Sigma

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Vendor / product
Microsoft — Windows
Description (CISA)
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Added to KEV
2024-06-13
Due date
2024-07-04
Required action
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Known ransomware use
Known
CWE
CWE-269
CISA notes
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26169
https://nvd.nist.gov/vuln/detail/CVE-2024-26169
Elsewhere
cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

TechniqueMapping typeCTID commentStatus in v19.2
T1112 Modify Registry exploitation technique This vulnerability is a zero-day exploit that "manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and set the "Debugger" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges." This vulnerability has been exploited by the Black Basta ransomware group.
ref 1		 live
T1203 Exploitation for Client Execution exploitation technique This vulnerability is a zero-day exploit that "manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and set the "Debugger" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges." This vulnerability has been exploited by the Black Basta ransomware group.
ref 1		 live
T1059 Command and Scripting Interpreter primary impact This vulnerability is a zero-day exploit that "manipulates the Windows file werkernel.sys, which uses a null security descriptor when creating registry keys. Attackers create a registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe and set the "Debugger" value to the exploit's executable pathname. This allows the exploit to start a shell with administrative privileges." This vulnerability has been exploited by the Black Basta ransomware group.
ref 1		 live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059 Command and Scripting Interpreter primary impact

Sigma rules tagged attack.t1059 (95)

Suspicious Browser Child Process - MacOS mediumtest
Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Techniques: T1189T1203T1059
Add New Download Source To Winget mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-04-17 · logsource: product=windows category=process_creation · 05ebafc8-7aa2-4bcd-a269-2aec93f9e842
Detects usage of winget to add new additional download sources
Techniques: T1059
Potential Arbitrary Command Execution Via FTP.EXE mediumtest
Author: Victor Sergeev, oscd.community · 2020-10-09 (modified 2024-04-23) · logsource: product=windows category=process_creation · 06b401f4-107c-4ff9-947f-9ec1e7649f1e
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Techniques: T1059T1202
Use of Pcalua For Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · 2022-06-14 (modified 2023-01-04) · logsource: product=windows category=process_creation · 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.
Techniques: T1059
Shai-Hulud Malware Indicators - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · 11bb9b26-4179-4a06-afcb-1ec31fce1627
Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.
Techniques: T1059
Script Interpreter Execution From Suspicious Folder hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-08 (modified 2026-02-17) · logsource: product=windows category=process_creation · 1228c958-e64e-4e71-92ad-7d429f4138ba
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.
Techniques: T1059
DNS Request From Windows Script Host lowtest
Author: Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows category=dns_query · 12310575-e8b1-475c-a976-57ed540b349c
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Techniques: T1059
Windows Shell/Scripting Application File Write to Suspicious Folder hightest
Author: Florian Roth (Nextron Systems) · 2021-11-20 (modified 2023-03-29) · logsource: product=windows category=file_event · 1277f594-a7d1-4f28-a2d3-73af5cbeab43
Detects Windows shells and scripting applications that write files to suspicious folders
Techniques: T1059
Elevated System Shell Spawned From Uncommon Parent Location mediumtest
Author: frack113, Tim Shelton (update fp) · 2022-12-05 (modified 2025-03-06) · logsource: product=windows category=process_creation · 178e615d-e666-498b-9630-9ed363038101
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Techniques: T1059
DarkGate - Autoit3.EXE File Creation By Uncommon Process mediumtest
Author: Micah Babinski · 2023-10-15 · logsource: product=windows category=file_event · 1a433e1d-03d2-47a6-8063-ece992cf4e73
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.
Techniques: T1105T1059
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) mediumtest
Author: Andreas Braathen (mnemonic.io) · 2023-11-14 · logsource: product=windows category=process_creation · 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.
Techniques: T1059T1190
CVE tags: CVE-2023-22518
Ruby Inline Command Execution mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-01-02 · logsource: product=windows category=process_creation · 20a5ffa1-3848-4584-b6f8-c7c7fd9f69c8
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.
Techniques: T1059
Payload Decoded and Decrypted via Built-in Utilities mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Techniques: T1059T1204T1140
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-14 · logsource: product=windows category=process_creation · 236d8e89-ed95-4789-a982-36f4643738ba
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Techniques: T1059
Renamed PingCastle Binary Execution hightest
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2024-01-11 · logsource: product=windows category=process_creation · 2433a154-bb3d-42e4-86c3-a26bdac91c45
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Techniques: T1059T1202

All 95 rules on the technique page →

T1112 Modify Registry exploitation technique

Sigma rules tagged attack.t1112 (96)

DNS-over-HTTPS Enabled by Registry mediumtest
Author: Austin Songer · 2021-07-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 04b45a8a-d11d-49e4-9acc-4a1b524407a5
Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Techniques: T1140T1112
Terminal Server Client Connection History Cleared - Registry hightest
Author: Christian Burkard (Nextron Systems) · 2021-10-19 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
Detects the deletion of registry keys containing the MSTSC connection history
Techniques: T1070T1112
Imports Registry Key From an ADS hightest
Author: Oddvar Moe, Sander Wiebing, oscd.community · 2020-10-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 0b80ade5-6997-4b1d-99a1-71701778ea61
Detects the import of a alternate datastream to the registry with regedit.exe.
Techniques: T1112
Activate Suppression of Windows Security Center Notifications mediumtest
Author: frack113 · 2022-08-19 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Techniques: T1112
Potential Tampering With RDP Related Registry Keys Via Reg.EXE hightest
Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport · 2022-02-12 (modified 2025-11-22) · logsource: product=windows category=process_creation · 0d5675be-bc88-4172-86d3-1e96a4476536
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
Techniques: T1021.001T1112
Potential Raspberry Robin Registry Set Internet Settings ZoneMap lowtest
Author: Swachchhanda Shrawan Poudel · 2024-07-31 · logsource: product=windows category=registry_set · 16a4c7b3-4681-49d0-8d58-3e9b796dcb43
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024. Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Techniques: T1112
Sysmon Channel Reference Deletion hightest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-07-14 (modified 2025-10-22) · logsource: product=windows service=security · 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc
Potential threat actor tampering with Sysmon manifest and eventually disabling it
Techniques: T1112
Run Once Task Execution as Configured in Registry lowtest
Author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) · 2020-10-18 (modified 2022-12-13) · logsource: product=windows category=process_creation · 198effb6-6c98-4d0c-9ea3-451fa143c45c
This rule detects the execution of Run Once task as configured in the registry
Techniques: T1112
Wdigest CredGuard Registry Modification hightest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2019-08-25 (modified 2021-11-27) · logsource: product=windows category=registry_event · 1a2d6c47-75b0-45bd-b133-2c0be75349fd
Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.
Techniques: T1112
Security Event Logging Disabled via MiniNt Registry Key - Process highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-04-09 · logsource: product=windows category=process_creation · 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
Techniques: T1685.001T1112
Trust Access Disable For VBApplications hightest
Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) · 2020-05-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
Techniques: T1112
Registry Explorer Policy Modification mediumtest
Author: frack113 · 2022-03-18 (modified 2023-08-17) · logsource: product=windows category=registry_set · 1c3121ed-041b-4d97-a075-07f54f20fb4a
Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)
Techniques: T1112
Potential Qakbot Registry Activity hightest
Author: Hieu Tran · 2023-03-13 · logsource: product=windows category=registry_event · 1c8e96cd-2bed-487d-9de0-b46c90cade56
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
Techniques: T1112
Potential NetWire RAT Activity - Registry hightest
Author: Christopher Peacock · 2021-10-07 (modified 2025-11-03) · logsource: product=windows category=registry_add · 1d218616-71b0-4c40-855b-9dbe75510f7f
Detects registry keys related to NetWire RAT
Techniques: T1112
Potential Ursnif Malware Activity - Registry hightest
Author: megan201296 · 2019-02-13 (modified 2025-10-22) · logsource: product=windows category=registry_add · 21f17060-b282-4249-ade0-589ea3591558
Detects registry keys related to Ursnif malware.
Techniques: T1112

All 96 rules on the technique page →

T1203 Exploitation for Client Execution exploitation technique

Sigma rules tagged attack.t1203 (35)

Download From Suspicious TLD - Blacklist lowtest
Author: Florian Roth (Nextron Systems) · 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Techniques: T1566T1203T1204.002
Suspicious HWP Sub Processes hightest
Author: Florian Roth (Nextron Systems) · 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Techniques: T1566.001T1203T1059.003
Suspicious Browser Child Process - MacOS mediumtest
Author: Sohan G (D4rkCiph3r) · 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Techniques: T1189T1203T1059
Antivirus - APT Malware Signature criticalexperimental
Author: Arnim Rupp (Nextron Systems) · 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a
Detects a highly relevant Antivirus alert that reports APT malware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Techniques: T1203T1219.002
Potentially Suspicious Child Process Of WinRAR.EXE mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76
Detects potentially suspicious child processes of WinRAR.exe.
Techniques: T1203
OMIGOD SCX RunAsProvider ExecuteShellCommand hightest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Techniques: T1068T1190T1203
Antivirus - Exploitation Framework Signature criticalstable
Author: Florian Roth (Nextron Systems), Arnim Rupp · 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864
Detects a highly relevant Antivirus alert that reports an exploitation framework. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Techniques: T1203T1219.002
Suspicious Invocation of Shell via Rsync highexperimental
Author: Florian Roth · 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Techniques: T1059T1203
CVE-2021-31979 CVE-2021-33771 Exploits criticaltest
Author: Sittikorn S, frack113 · 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Techniques: T1566T1203
CVE tags: CVE-2021-33771CVE-2021-31979
Dfsvc.EXE Network Connection To Non-Local IPs mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Techniques: T1203
Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.
Techniques: T1190T1203
CVE tags: CVE-2025-4427CVE-2025-4428
Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process highexperimental
Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Techniques: T1190T1203
CVE tags: CVE-2025-59287
Audit CVE Event criticaltest
Author: Florian Roth (Nextron Systems), Zach Mathis · 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability. Unfortunately, that is about the only instance of CVEs being written to this log.
Techniques: T1203T1068T1211T1212T1210T1499.004
Dfsvc.EXE Initiated Network Connection Over Uncommon Port hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741
Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
Techniques: T1203
Shai-Hulud Malicious Bun Execution highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
Techniques: T1195.002T1203

All 35 rules on the technique page →