Detect CVE-2023-36424 - Microsoft Windows Out-of-Bounds Read Exploitation in CrowdStrike LogScale
Detects exploitation attempts of CVE-2023-36424, a Microsoft Windows out-of-bounds read vulnerability (CWE-125) listed in CISA's Known Exploited Vulnerabilities catalog. Out-of-bounds read vulnerabilities in Windows kernel or system components can be leveraged for privilege escalation, information disclosure, or as a stepping stone in exploit chains. This detection monitors for anomalous process behavior, crash artifacts, and privilege escalation patterns consistent with exploitation of this class of vulnerability.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2", "CrashAnalysisNotification")
| filter FileName IN ("werfault.exe", "WerFault.exe", "ReportFault.exe")
OR (#event_simpleName = "UserLogon" AND LogonType_decimal != "5" AND NOT UserName ends with "$")
OR (#event_simpleName = "CrashAnalysisNotification")
| eval risk_indicator = case(
FileName IN ("werfault.exe", "WerFault.exe"), "crash_artifact",
#event_simpleName = "CrashAnalysisNotification", "crash_notification",
#event_simpleName = "UserLogon", "interactive_logon",
true(), "unknown"
)
| stats count() as event_count, values(UserName) as users, values(ComputerName) as hosts by risk_indicator, FileName
| where event_count > 0
| eval cve = "CVE-2023-36424"
| table cve, risk_indicator, FileName, event_count, users, hostsCrowdStrike Falcon Query Language detection for CVE-2023-36424 indicators including crash artifact process events, WerFault launches, and anomalous interactive logon patterns on Windows hosts.
Data Sources
Required Tables
False Positives & Tuning
- WerFault.exe launches from legitimate application crashes on hosts with unstable software
- Interactive logons by administrators during normal maintenance windows
- Security orchestration tools that trigger crash analysis as part of automated response
- Software testers deliberately causing application faults in QA environments
Other platforms for CVE-2023-36424
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Out-of-Bounds Read Crash via Malformed Input
Expected signal: Windows Event ID 1000 (Application Error) and 1001 (WER) in Application log; WerFault.exe process launch visible in Sysmon Event ID 1; crash dump file created in %LOCALAPPDATA%\CrashDumps
- Test 2Privilege Escalation Simulation Following Crash Artifact
Expected signal: Windows Event ID 4672 (Special Privileges Assigned) in Security log; Process creation events in Sysmon for cmd.exe and powershell.exe; elevated process token in DeviceProcessEvents
- Test 3Memory Dump Creation Mimicking Exploit Artifact
Expected signal: Sysmon Event ID 11 (FileCreate) for .dmp file in CrashDumps directory; DeviceFileEvents entry for the dump file creation; rundll32.exe process creation with comsvcs.dll MiniDump arguments in process telemetry
- Test 4WerFault.exe Manual Invocation Simulation
Expected signal: Sysmon Event ID 1 showing WerFault.exe launched by PowerShell (non-standard parent); DeviceProcessEvents with FileName=werfault.exe and InitiatingProcessFileName=powershell.exe; potential Event ID 1001 in Application log
Response Playbook
Triage
- Identify the affected Windows host(s) and correlate crash artifacts (WerFault.exe invocations, crash dumps in %LOCALAPPDATA%\CrashDumps or %WINDIR%\Minidump) with the timeline of the alert to determine if exploitation preceded the crash.
- Review Windows Event Log 4672 (Special Privileges Assigned to New Logon) events on the affected host within 30 minutes of the crash artifact to assess whether the out-of-bounds read was used for privilege escalation.
- Check the patch status of the affected Windows system against Microsoft's advisory for CVE-2023-36424 — determine if the relevant security update has been applied and note the current patch level.
- Inspect parent-child process relationships around the time of the crash artifact using EDR telemetry to identify whether a suspicious or unexpected process triggered the faulting component.
- Verify whether the affected account has subsequently accessed sensitive resources (domain controllers, credential stores, sensitive file shares) that would indicate successful post-exploitation activity.
Containment
- If active exploitation is confirmed or strongly suspected, isolate the affected host from the network using EDR network containment or VLAN isolation to prevent lateral movement while preserving forensic state.
- Revoke and rotate credentials for any user accounts that were active on the affected host during the exploitation window, particularly privileged accounts, as out-of-bounds read vulnerabilities can expose credential material in memory.
- Apply the Microsoft security patch for CVE-2023-36424 to the affected host and all unpatched Windows systems in the environment as emergency remediation, following change management procedures.
Evidence Collection
- Collect Windows crash dump files from %LOCALAPPDATA%\CrashDumps, %WINDIR%\Minidump, and %TEMP% directories on the affected host and preserve them for memory forensics analysis to identify exploitation artifacts.
- Export Windows Security Event Log (EVTX) and Sysmon logs from the affected host covering the 2-hour window surrounding the alert, preserving the originals with cryptographic hashes for chain of custody.
- Capture a full memory image of the affected host if the system is believed to be actively compromised, using an approved forensic tool (e.g., WinPmem, DumpIt) to support analysis of in-memory exploitation artifacts.
Escalation Criteria
- !Escalate immediately to incident response if privilege escalation to SYSTEM or Domain Admin is confirmed following the exploitation indicator, or if lateral movement to other hosts is detected within the same timeframe.
- !Escalate if multiple hosts across the environment exhibit simultaneous crash artifacts and privilege escalation events, which may indicate a coordinated or worm-like exploitation campaign leveraging CVE-2023-36424.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows crash dump files (.dmp) in %LOCALAPPDATA%\CrashDumps or %WINDIR%\Minidump containing exploit shellcode or unusual stack frames - >
Windows Event ID 1000/1001 (Application Error / Windows Error Reporting) in Application event log indicating the faulting module and offset - >
Windows Event ID 4672 (Special Privileges Assigned to New Logon) immediately following crash events indicating privilege escalation success - >
Prefetch files (.pf) for werfault.exe, unusual parent processes, or attacker tooling under %WINDIR%\Prefetch - >
Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create) logs capturing crash dump file creation and associated parent-child process chains
Tuning Guidance
This detection generates a broad signal due to the nature of Windows crash reporting and privilege events in enterprise environments. Begin by baselining WerFault.exe invocation frequency per host and suppressing known-noisy hosts (QA machines, developer workstations, software testing environments). Add exclusions for service accounts and machine accounts (ending in $) generating 4672 events as part of normal operations. For higher-fidelity detection, tune to correlate both a crash artifact AND a privilege escalation event on the same host within a short time window (5-15 minutes) rather than triggering on either alone. Additionally, enrich alerts with patch status data to prioritize unpatched hosts and deprioritize alerts from systems confirmed to have CVE-2023-36424 remediated.
Hunting Queries
Hunt for accounts or hosts with elevated crash rates over 7 days that may indicate repeated exploitation attempts or fuzzing of the vulnerable Windows component.
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "werfault.exe"
| where InitiatingProcessFileName !in~ ("svchost.exe", "services.exe", "taskmgr.exe")
| summarize crash_count=count(), hosts=make_set(DeviceName), parent_procs=make_set(InitiatingProcessFileName) by AccountName
| where crash_count > 3
| order by crash_count descindex=wineventlog EventCode=1000 OR EventCode=1001
| stats count as crash_count, values(host) as hosts, values(Application) as apps by User
| where crash_count > 3 AND NOT User="SYSTEM"
| sort -crash_countHunt for privilege escalation events (4672) occurring within 15 minutes of crash artifacts on the same host, which may indicate successful exploitation of CVE-2023-36424 resulting in elevated access.
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID == 4672
| where SubjectUserName !endswith "$" and SubjectUserName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| join kind=inner (
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "werfault.exe"
| project crash_time=Timestamp, DeviceName, AccountName
) on $left.Computer == $right.DeviceName
| where abs(datetime_diff('minute', TimeGenerated, crash_time)) <= 15
| project TimeGenerated, Computer, SubjectUserName, crash_time, AccountName
| order by TimeGenerated descindex=wineventlog EventCode=4672 NOT SubjectUserName="*$" NOT SubjectUserName IN ("SYSTEM","LOCAL SERVICE","NETWORK SERVICE")
| eval privesc_time=_time
| join ComputerName [
search index=wineventlog EventCode IN (1000, 1001)
| eval crash_time=_time
| table ComputerName, crash_time
]
| where abs(privesc_time - crash_time) < 900
| table _time, ComputerName, SubjectUserName, privesc_time, crash_timeAtomic Red Team Tests
Simulates triggering an out-of-bounds read condition in a Windows process by providing malformed input designed to cause a controlled crash, mimicking the class of vulnerability represented by CVE-2023-36424. This generates crash artifacts (WerFault.exe, minidump) observable by detection logic.
Command
powershell -ExecutionPolicy Bypass -Command "$bytes = [byte[]]::new(65536); [System.Runtime.InteropServices.Marshal]::Copy([System.Runtime.InteropServices.Marshal]::AllocHGlobal(65536), $bytes, 0, 65536); Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class CrashTest { [DllImport(\"ntdll.dll\")] public static extern int NtRaiseException(IntPtr ExceptionRecord, IntPtr ContextRecord, bool SearchFrames); }'; Write-Host 'Crash simulation initiated - generating WerFault artifact'"Cleanup
Remove-Item -Path "$env:LOCALAPPDATA\CrashDumps\*.dmp" -Force -ErrorAction SilentlyContinueExpected Telemetry
Windows Event ID 1000 (Application Error) and 1001 (WER) in Application log; WerFault.exe process launch visible in Sysmon Event ID 1; crash dump file created in %LOCALAPPDATA%\CrashDumps
Expected Detection
Detection should fire on WerFault.exe process creation from a non-system parent process and the associated Windows Error Reporting event in the Security/Application log
Simulates the post-exploitation pattern where an attacker achieves privilege escalation (logged as Windows Event ID 4672) shortly after triggering a crash in a vulnerable Windows component. This tests the correlation logic of the detection.
Command
cmd.exe /c "whoami /priv && net localgroup administrators %USERNAME% 2>&1 | echo Privilege check complete" && powershell -Command "Start-Process cmd.exe -Verb RunAs -ArgumentList '/c whoami /all > C:\\Temp\\priv_check.txt 2>&1' -Wait"Cleanup
del /f /q C:\Temp\priv_check.txt 2>nulExpected Telemetry
Windows Event ID 4672 (Special Privileges Assigned) in Security log; Process creation events in Sysmon for cmd.exe and powershell.exe; elevated process token in DeviceProcessEvents
Expected Detection
Detection correlation between crash artifact and subsequent 4672 event on same host within configured time window should produce a high-risk alert
Generates a process memory dump file in the standard Windows crash dump location to simulate the forensic artifact left by exploitation of CVE-2023-36424. Tests file creation monitoring and crash dump detection rules.
Command
powershell -ExecutionPolicy Bypass -Command "$dumpPath = Join-Path $env:LOCALAPPDATA 'CrashDumps'; New-Item -ItemType Directory -Path $dumpPath -Force | Out-Null; $pid = (Get-Process -Name 'notepad' -ErrorAction SilentlyContinue)?.Id; if (-not $pid) { Start-Process notepad; Start-Sleep 2; $pid = (Get-Process notepad).Id }; & 'C:\Windows\System32\rundll32.exe' C:\Windows\System32\comsvcs.dll MiniDump $pid (Join-Path $dumpPath 'simulated_crash.dmp') full; Write-Host 'Dump created at' (Join-Path $dumpPath 'simulated_crash.dmp')"Cleanup
Remove-Item -Path "$env:LOCALAPPDATA\CrashDumps\simulated_crash.dmp" -Force -ErrorAction SilentlyContinue; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11 (FileCreate) for .dmp file in CrashDumps directory; DeviceFileEvents entry for the dump file creation; rundll32.exe process creation with comsvcs.dll MiniDump arguments in process telemetry
Expected Detection
File creation monitoring for .dmp files in CrashDumps directories and rundll32.exe MiniDump invocation should trigger memory dump artifact detection rules
Directly invokes WerFault.exe with parameters mimicking a crash report submission to test detection of Windows Error Reporting process launches from anomalous parent processes, a key indicator of CVE-2023-36424 exploitation activity.
Command
powershell -ExecutionPolicy Bypass -Command "$proc = Start-Process -FilePath 'C:\Windows\System32\WerFault.exe' -ArgumentList '-u -p', (Get-Process powershell | Select-Object -First 1 -ExpandProperty Id) -PassThru; Start-Sleep 3; if (-not $proc.HasExited) { $proc.Kill() }; Write-Host 'WerFault simulation complete'"Cleanup
Stop-Process -Name WerFault -Force -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1 showing WerFault.exe launched by PowerShell (non-standard parent); DeviceProcessEvents with FileName=werfault.exe and InitiatingProcessFileName=powershell.exe; potential Event ID 1001 in Application log
Expected Detection
Process creation detection for WerFault.exe launched from PowerShell or other non-standard parent processes should generate an alert for analyst review