RoguePlanet wermgr.exe Masquerade - Anomalous Child Process via QueueReporting Task
Detects the RoguePlanet exploit chain where an attacker-planted binary masquerading as wermgr.exe is executed by the QueueReporting scheduled task under SYSTEM integrity and spawns an interactive shell process (conhost.exe, cmd.exe, powershell.exe). Legitimate wermgr.exe instances related to error reporting do not spawn interactive console processes.
Sigma
