RoguePlanet QueueReporting Task Abused to Execute wermgr.exe from Non-System32 Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•8

Detects execution of wermgr.exe from suspicious, non-standard directories (such as temp or user-writable paths). This behavior is indicative of the 'RoguePlanet' exploit, which leverages a junction swap to replace the legitimate Windows Error Reporting binary with a malicious payload, executed via the WER QueueReporting scheduled task.