BlueHammer Unpatched LPE: Detecting Windows Error Reporting Abuse

---
title: BlueHammer - Suspicious WerFault.exe Child Process
id: 8a4b2c13-9d1e-4f5a-8b2c-1d3e4f5a6b7c
status: experimental
description: Detects potential exploitation of the BlueHammer vulnerability by identifying WerFault.exe spawning suspicious child processes like cmd or powershell.
references:
 - https://www.darkreading.com/vulnerabilities-threats/bluehammer-windows-exploit-microsoft-bug-disclosure-issues
author: Security Arsenal
date: 2024/05/20
tags:
 - attack.privilege_escalation
 - attack.t1068
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith: '\WerFault.exe'
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\pwsh.exe'
 condition: selection
falsepositives:
  - Rare legitimate debugging scenarios (unlikely in production)
level: critical
---
title: BlueHammer - WerFault.exe Network Connection
id: 9c5d3e24-0e2f-5a6b-9c3d-2e4f5a6b7c8d
status: experimental
description: Detects WerFault.exe initiating network connections, which is highly unusual and indicative of exploitation or malicious payload delivery.
references:
 - https://www.darkreading.com/vulnerabilities-threats/bluehammer-windows-exploit-microsoft-bug-disclosure-issues
author: Security Arsenal
date: 2024/05/20
tags:
 - attack.command_and_control
 - attack.t1071
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   Image|endswith: '\WerFault.exe'
   Initiated: 'true'
 condition: selection
falsepositives:
  - None
level: high

// Hunt for WerFault.exe spawning unauthorized shells
DeviceProcessEvents
| where InitiatingProcessFileName =~ "WerFault.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessId
| order by Timestamp desc

-- Hunt for WerFault.exe processes and inspect their children
SELECT
  Pid AS ProcessPID,
  Name AS ProcessName,
  CommandLine,
  Username,
  StartTime
FROM pslist()
WHERE Name =~ "WerFault"

-- Chain query to find children of WerFault (Requires generic chaining logic in VQL)
-- SELECT * FROM chain(
--   query={ SELECT Pid FROM pslist() WHERE Name =~ "WerFault" },
--   func={ SELECT Pid, Name, CommandLine FROM pslist() WHERE PPid in _ },
--   key={ "Pid" }
-- )

<#
.SYNOPSIS
    Audit and Mitigate BlueHammer Vulnerability (WER Abuse)
.DESCRIPTION
    Checks for the presence of the BlueHammer PoC and tightens ACLs on WER directories as a temporary mitigation.
#>

Write-Host "[+] Checking for BlueHammer PoC artifacts..."
$poctPath = "C:\Windows\Temp\BlueHammer"
if (Test-Path $poctPath) {
    Write-Host "[!] WARNING: BlueHammer artifact found at $poctPath" -ForegroundColor Red
} else {
    Write-Host "[-] No common BlueHammer artifacts found." -ForegroundColor Green
}

Write-Host "[+] Auditing WER Directory Permissions..."
$werPath = "$env:ProgramData\Microsoft\Windows\WER"
$acl = Get-Acl $werPath
$accessRules = $acl.Access | Where-Object { $_.IdentityReference -like "*Users*" -or $_.IdentityReference -like "*Authenticated Users*" }

if ($accessRules) {
    Write-Host "[!] WARNING: Weak permissions found on WER directory." -ForegroundColor Yellow
    Write-Host $accessRules.IdentityReference -ForegroundColor Yellow
    # Mitigation: Remove excessive write permissions (Example only - validate in lab)
    # $acl.SetAccessRuleProtection($true, $false)
    # Set-Acl $werPath $acl
} else {
    Write-Host "[-] Permissions appear restricted." -ForegroundColor Green
}

Write-Host "[+] Reviewing recent WerFault.exe activity..."
Get-WinEvent -LogName Microsoft-Windows-WER-Operational -MaxEvents 20 -ErrorAction SilentlyContinue | 
    Select-Object TimeCreated, Message | Format-Table -AutoSize