Potential ReflectDebugger Content Execution Via WerFault.EXE
Detects the execution of "WerFault.exe" with the "-pr" command-line flag. This specific command-line argument is used to run files stored in the ReflectDebugger registry key, which can be abused by adversaries to masquerade execution flow and achieve persistence or defense evasion by leveraging a legitimate Windows error reporting process.
Sigma
