CVE-2023-36424 Splunk · SPL

Detect CVE-2023-36424 - Microsoft Windows Out-of-Bounds Read Exploitation in Splunk

Detects exploitation attempts of CVE-2023-36424, a Microsoft Windows out-of-bounds read vulnerability (CWE-125) listed in CISA's Known Exploited Vulnerabilities catalog. Out-of-bounds read vulnerabilities in Windows kernel or system components can be leveraged for privilege escalation, information disclosure, or as a stepping stone in exploit chains. This detection monitors for anomalous process behavior, crash artifacts, and privilege escalation patterns consistent with exploitation of this class of vulnerability.

MITRE ATT&CK

Tactic
Privilege Escalation Credential Access Execution

SPL Detection Query

Splunk (SPL)
spl 
index=wineventlog OR index=sysmon sourcetype IN ("WinEventLog:Security", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval event_time=_time
| where earliest=-24h
| eval is_crash_event=if(EventCode=="1000" OR EventCode=="1001" OR (EventCode=="4688" AND like(NewProcessName, "%werfault%")), 1, 0)
| eval is_privesc=if(EventCode=="4672" AND NOT like(SubjectUserName, "%$"), 1, 0)
| eval is_memory_violation=if(sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode="11" AND (like(TargetFilename, "%Watson%") OR like(TargetFilename, "%CrashDumps%")), 1, 0)
| eval risk_score=is_crash_event + is_privesc + is_memory_violation
| where risk_score >= 1
| stats count as event_count, sum(is_crash_event) as crash_events, sum(is_privesc) as privesc_events, sum(is_memory_violation) as memory_events, values(host) as hosts, values(SubjectUserName) as users by ComputerName
| where event_count > 0
| eval cve="CVE-2023-36424"
| table _time, ComputerName, hosts, users, event_count, crash_events, privesc_events, memory_events, cve
high severity medium confidence

Splunk correlation search detecting CVE-2023-36424 exploitation indicators across Windows Security event logs and Sysmon. Scores events based on crash artifacts, privilege escalation, and memory violation indicators.

Data Sources

Windows Security Event LogSysmon

Required Sourcetypes

WinEventLog:SecurityXmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Legitimate software crashes on hosts running unstable or beta software builds
  • System administrators performing privilege-sensitive operations that generate 4672 events
  • Crash dump collection by monitoring tools creating files in CrashDumps directories
  • Windows Error Reporting collecting telemetry from non-malicious application faults

Other platforms for CVE-2023-36424

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Out-of-Bounds Read Crash via Malformed Input

    Expected signal: Windows Event ID 1000 (Application Error) and 1001 (WER) in Application log; WerFault.exe process launch visible in Sysmon Event ID 1; crash dump file created in %LOCALAPPDATA%\CrashDumps

  2. Test 2Privilege Escalation Simulation Following Crash Artifact

    Expected signal: Windows Event ID 4672 (Special Privileges Assigned) in Security log; Process creation events in Sysmon for cmd.exe and powershell.exe; elevated process token in DeviceProcessEvents

  3. Test 3Memory Dump Creation Mimicking Exploit Artifact

    Expected signal: Sysmon Event ID 11 (FileCreate) for .dmp file in CrashDumps directory; DeviceFileEvents entry for the dump file creation; rundll32.exe process creation with comsvcs.dll MiniDump arguments in process telemetry

  4. Test 4WerFault.exe Manual Invocation Simulation

    Expected signal: Sysmon Event ID 1 showing WerFault.exe launched by PowerShell (non-standard parent); DeviceProcessEvents with FileName=werfault.exe and InitiatingProcessFileName=powershell.exe; potential Event ID 1001 in Application log

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected Windows host(s) and correlate crash artifacts (WerFault.exe invocations, crash dumps in %LOCALAPPDATA%\CrashDumps or %WINDIR%\Minidump) with the timeline of the alert to determine if exploitation preceded the crash.
  2. Review Windows Event Log 4672 (Special Privileges Assigned to New Logon) events on the affected host within 30 minutes of the crash artifact to assess whether the out-of-bounds read was used for privilege escalation.
  3. Check the patch status of the affected Windows system against Microsoft's advisory for CVE-2023-36424 — determine if the relevant security update has been applied and note the current patch level.
  4. Inspect parent-child process relationships around the time of the crash artifact using EDR telemetry to identify whether a suspicious or unexpected process triggered the faulting component.
  5. Verify whether the affected account has subsequently accessed sensitive resources (domain controllers, credential stores, sensitive file shares) that would indicate successful post-exploitation activity.

Containment

  1. If active exploitation is confirmed or strongly suspected, isolate the affected host from the network using EDR network containment or VLAN isolation to prevent lateral movement while preserving forensic state.
  2. Revoke and rotate credentials for any user accounts that were active on the affected host during the exploitation window, particularly privileged accounts, as out-of-bounds read vulnerabilities can expose credential material in memory.
  3. Apply the Microsoft security patch for CVE-2023-36424 to the affected host and all unpatched Windows systems in the environment as emergency remediation, following change management procedures.

Evidence Collection

  1. Collect Windows crash dump files from %LOCALAPPDATA%\CrashDumps, %WINDIR%\Minidump, and %TEMP% directories on the affected host and preserve them for memory forensics analysis to identify exploitation artifacts.
  2. Export Windows Security Event Log (EVTX) and Sysmon logs from the affected host covering the 2-hour window surrounding the alert, preserving the originals with cryptographic hashes for chain of custody.
  3. Capture a full memory image of the affected host if the system is believed to be actively compromised, using an approved forensic tool (e.g., WinPmem, DumpIt) to support analysis of in-memory exploitation artifacts.

Escalation Criteria

  • !Escalate immediately to incident response if privilege escalation to SYSTEM or Domain Admin is confirmed following the exploitation indicator, or if lateral movement to other hosts is detected within the same timeframe.
  • !Escalate if multiple hosts across the environment exhibit simultaneous crash artifacts and privilege escalation events, which may indicate a coordinated or worm-like exploitation campaign leveraging CVE-2023-36424.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Windows crash dump files (.dmp) in %LOCALAPPDATA%\CrashDumps or %WINDIR%\Minidump containing exploit shellcode or unusual stack frames
  • >Windows Event ID 1000/1001 (Application Error / Windows Error Reporting) in Application event log indicating the faulting module and offset
  • >Windows Event ID 4672 (Special Privileges Assigned to New Logon) immediately following crash events indicating privilege escalation success
  • >Prefetch files (.pf) for werfault.exe, unusual parent processes, or attacker tooling under %WINDIR%\Prefetch
  • >Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create) logs capturing crash dump file creation and associated parent-child process chains

Tuning Guidance

This detection generates a broad signal due to the nature of Windows crash reporting and privilege events in enterprise environments. Begin by baselining WerFault.exe invocation frequency per host and suppressing known-noisy hosts (QA machines, developer workstations, software testing environments). Add exclusions for service accounts and machine accounts (ending in $) generating 4672 events as part of normal operations. For higher-fidelity detection, tune to correlate both a crash artifact AND a privilege escalation event on the same host within a short time window (5-15 minutes) rather than triggering on either alone. Additionally, enrich alerts with patch status data to prioritize unpatched hosts and deprioritize alerts from systems confirmed to have CVE-2023-36424 remediated.

Hunting Queries

Hunt for accounts or hosts with elevated crash rates over 7 days that may indicate repeated exploitation attempts or fuzzing of the vulnerable Windows component.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName =~ "werfault.exe"
| where InitiatingProcessFileName !in~ ("svchost.exe", "services.exe", "taskmgr.exe")
| summarize crash_count=count(), hosts=make_set(DeviceName), parent_procs=make_set(InitiatingProcessFileName) by AccountName
| where crash_count > 3
| order by crash_count desc
Hunting — SPL
spl 
index=wineventlog EventCode=1000 OR EventCode=1001
| stats count as crash_count, values(host) as hosts, values(Application) as apps by User
| where crash_count > 3 AND NOT User="SYSTEM"
| sort -crash_count

Hunt for privilege escalation events (4672) occurring within 15 minutes of crash artifacts on the same host, which may indicate successful exploitation of CVE-2023-36424 resulting in elevated access.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID == 4672
| where SubjectUserName !endswith "$" and SubjectUserName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp >= ago(7d)
    | where FileName =~ "werfault.exe"
    | project crash_time=Timestamp, DeviceName, AccountName
  ) on $left.Computer == $right.DeviceName
| where abs(datetime_diff('minute', TimeGenerated, crash_time)) <= 15
| project TimeGenerated, Computer, SubjectUserName, crash_time, AccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog EventCode=4672 NOT SubjectUserName="*$" NOT SubjectUserName IN ("SYSTEM","LOCAL SERVICE","NETWORK SERVICE")
| eval privesc_time=_time
| join ComputerName [
    search index=wineventlog EventCode IN (1000, 1001)
    | eval crash_time=_time
    | table ComputerName, crash_time
  ]
| where abs(privesc_time - crash_time) < 900
| table _time, ComputerName, SubjectUserName, privesc_time, crash_time

Atomic Red Team Tests

Test 1 Simulate Out-of-Bounds Read Crash via Malformed Input
windows

Simulates triggering an out-of-bounds read condition in a Windows process by providing malformed input designed to cause a controlled crash, mimicking the class of vulnerability represented by CVE-2023-36424. This generates crash artifacts (WerFault.exe, minidump) observable by detection logic.

Command

powershell 
powershell -ExecutionPolicy Bypass -Command "$bytes = [byte[]]::new(65536); [System.Runtime.InteropServices.Marshal]::Copy([System.Runtime.InteropServices.Marshal]::AllocHGlobal(65536), $bytes, 0, 65536); Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class CrashTest { [DllImport(\"ntdll.dll\")] public static extern int NtRaiseException(IntPtr ExceptionRecord, IntPtr ContextRecord, bool SearchFrames); }'; Write-Host 'Crash simulation initiated - generating WerFault artifact'"

Cleanup

powershell 
Remove-Item -Path "$env:LOCALAPPDATA\CrashDumps\*.dmp" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Windows Event ID 1000 (Application Error) and 1001 (WER) in Application log; WerFault.exe process launch visible in Sysmon Event ID 1; crash dump file created in %LOCALAPPDATA%\CrashDumps

Expected Detection

Detection should fire on WerFault.exe process creation from a non-system parent process and the associated Windows Error Reporting event in the Security/Application log

Test 2 Privilege Escalation Simulation Following Crash Artifact
windows

Simulates the post-exploitation pattern where an attacker achieves privilege escalation (logged as Windows Event ID 4672) shortly after triggering a crash in a vulnerable Windows component. This tests the correlation logic of the detection.

Command

powershell 
cmd.exe /c "whoami /priv && net localgroup administrators %USERNAME% 2>&1 | echo Privilege check complete" && powershell -Command "Start-Process cmd.exe -Verb RunAs -ArgumentList '/c whoami /all > C:\\Temp\\priv_check.txt 2>&1' -Wait"

Cleanup

powershell 
del /f /q C:\Temp\priv_check.txt 2>nul

Expected Telemetry

Windows Event ID 4672 (Special Privileges Assigned) in Security log; Process creation events in Sysmon for cmd.exe and powershell.exe; elevated process token in DeviceProcessEvents

Expected Detection

Detection correlation between crash artifact and subsequent 4672 event on same host within configured time window should produce a high-risk alert

Test 3 Memory Dump Creation Mimicking Exploit Artifact
windows

Generates a process memory dump file in the standard Windows crash dump location to simulate the forensic artifact left by exploitation of CVE-2023-36424. Tests file creation monitoring and crash dump detection rules.

Command

powershell 
powershell -ExecutionPolicy Bypass -Command "$dumpPath = Join-Path $env:LOCALAPPDATA 'CrashDumps'; New-Item -ItemType Directory -Path $dumpPath -Force | Out-Null; $pid = (Get-Process -Name 'notepad' -ErrorAction SilentlyContinue)?.Id; if (-not $pid) { Start-Process notepad; Start-Sleep 2; $pid = (Get-Process notepad).Id }; & 'C:\Windows\System32\rundll32.exe' C:\Windows\System32\comsvcs.dll MiniDump $pid (Join-Path $dumpPath 'simulated_crash.dmp') full; Write-Host 'Dump created at' (Join-Path $dumpPath 'simulated_crash.dmp')"

Cleanup

powershell 
Remove-Item -Path "$env:LOCALAPPDATA\CrashDumps\simulated_crash.dmp" -Force -ErrorAction SilentlyContinue; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) for .dmp file in CrashDumps directory; DeviceFileEvents entry for the dump file creation; rundll32.exe process creation with comsvcs.dll MiniDump arguments in process telemetry

Expected Detection

File creation monitoring for .dmp files in CrashDumps directories and rundll32.exe MiniDump invocation should trigger memory dump artifact detection rules

Test 4 WerFault.exe Manual Invocation Simulation
windows

Directly invokes WerFault.exe with parameters mimicking a crash report submission to test detection of Windows Error Reporting process launches from anomalous parent processes, a key indicator of CVE-2023-36424 exploitation activity.

Command

powershell 
powershell -ExecutionPolicy Bypass -Command "$proc = Start-Process -FilePath 'C:\Windows\System32\WerFault.exe' -ArgumentList '-u -p', (Get-Process powershell | Select-Object -First 1 -ExpandProperty Id) -PassThru; Start-Sleep 3; if (-not $proc.HasExited) { $proc.Kill() }; Write-Host 'WerFault simulation complete'"

Cleanup

powershell 
Stop-Process -Name WerFault -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing WerFault.exe launched by PowerShell (non-standard parent); DeviceProcessEvents with FileName=werfault.exe and InitiatingProcessFileName=powershell.exe; potential Event ID 1001 in Application log

Expected Detection

Process creation detection for WerFault.exe launched from PowerShell or other non-standard parent processes should generate an alert for analyst review

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0006Credential AccessTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1203Exploitation for Client ExecutionT1212Exploitation for Credential Access

Same Tactic: Privilege Escalation

Popular Detections