Suspicious Child Process Of Wermgr.EXE
Detects suspicious child processes spawned by wermgr.exe (Windows Error Reporting manager). Adversaries may abuse wermgr.exe to execute arbitrary commands or scripts, often as a method of defense evasion or privilege escalation. The rule specifically looks for common command-line utilities and scripting engines being launched as children of wermgr.exe, while filtering out known legitimate rundll32.exe activity related to WerConCpl.dll.
Sigma
