Suspicious Execution Location of Wermgr.EXE
Detects the execution of 'wermgr.exe' from an unusual or suspicious file path. Legitimate 'wermgr.exe' executions typically originate from 'C:\Windows\System32\', 'C:\Windows\SysWOW64\', or 'C:\Windows\WinSxS\'. Adversaries may rename or move legitimate Windows binaries to evade detection or blend in with normal system activity.
Sigma
