RoguePlanet CVE-2026-50656 Oplock on VSS-Resident wermgr.exe or :WDFOO ADS
Detects instances of wermgr.exe (Windows Error Reporting) interacting with Volume Shadow Copies or using specific Alternate Data Streams (WDFOO). This behavior is often associated with credential dumping tools (e.g., Mimikatz, SharpShadow) attempting to access sensitive files from shadow copies under the context of a non-system user, potentially indicating evasion techniques or credential harvesting.
Cortex XDR
