RoguePlanet: wermgr.exe spawned as SYSTEM via WER QueueReporting task

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.