RoguePlanet: LockFile on VSS-Backed wermgr.exe via Shadow Copy (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects instances where the Windows Error Reporting process (wermgr.exe) attempts to open files located within a Volume Shadow Copy path. This behavior is atypical and may indicate an attempt to access sensitive files from a shadow copy, a technique often used in credential dumping or discovery activities.