RoguePlanet wermgr.exe Executed from Temp Directory via Junction Hijack

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the execution of wermgr.exe from a non-standard directory, specifically targeting the RoguePlanet junction-hijacking technique where the Windows Error Reporting process is replaced by an attacker-controlled binary under a staging path (e.g., %TEMP%\RP_*).