RoguePlanet: QueueReporting Task COM Trigger Executing wermgr.exe Outside System32

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious activity involving the Windows Error Reporting service (wermgr.exe). It monitors for two primary conditions: 1) Execution of wermgr.exe from a location other than the standard System32 directory, indicating potential binary masquerading. 2) wermgr.exe spawning common command-line shells (cmd, powershell, etc.) while running under the SYSTEM account, which is indicative of potential task abuse or privilege escalation.