WER QueueReporting Task Trigger via schtasks or COM API

Ethan Andrews@eandrews

•updated Jun 10, 2026•33•0•69

Detects manual or programmatic triggering of the Windows Error Reporting 'QueueReporting' scheduled task. The RoguePlanet exploit abuses this task to execute an overwritten wermgr.exe binary as SYSTEM. This rule identifies execution via 'schtasks.exe /run' command line or via COM API calls reflected in Task Scheduler Operational logs.