RoguePlanet: wermgr.exe Execution Outside System32 via Defender Quarantine Hijack

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the execution of 'wermgr.exe' from a path other than the expected 'C:\Windows\System32'. This behavior is indicative of the 'RoguePlanet' exploit, where an adversary replaces a Windows Defender quarantine artifact with a malicious payload and triggers it via the 'QueueReporting' scheduled task, running with NT AUTHORITY\SYSTEM privileges.