RoguePlanet CVE-2026-50656 wermgr.exe Spawning Interactive Shell via QueueReporting Task

Ibrahim Saud@tektrix

•updated Jun 30, 2026•6•0•11

Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.