RoguePlanet: conhost.exe Spawned as SYSTEM from wermgr.exe (CVE-2026-50656)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•13

Detects instances where the Console Host process (conhost.exe) is executed at a System integrity level with a parent process of the Windows Error Reporter (wermgr.exe). This pattern is atypical as conhost.exe typically runs within the context of the user session or the initiating process, and spawning it from wermgr.exe at System level may indicate an attempt to hide a console window or manipulate system processes via an elevated parent.