huntrule

Suspicious wermgr Execution Outside System Directories via process_creation

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-10
Updated
2026-10-10
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Windows Error Reporting Manager wermgr.exe running from a path outside System32 and SysWOW64. The MiniPlasma exploitation chain launches a masqueraded wermgr.exe from an unexpected location. A trusted system binary name executing from the wrong directory indicates masquerading and likely process injection.

Reporting behind it

Related detections9 linkedT1036.005 — drag to rearrange
Suspicious Python Execution of Fake Sysmon Script From Config Directory
Suspicious vcpktsvr Loader Execution From LOCALAPPDATA vcpacket Directory
Suspicious Process Execution From Fake Microsoft Edge ExtSvc Directory
Suspicious kswapd0 Masquerading Miner Process
Suspicious msinfo32.exe Executed From ViPNet Update Directory
Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation
Malicious Svchost Impersonation From Non-System Path via process_creation
Malicious RustyStealer Masquerading as AudioDriver in Windows Temp
Suspicious svchost Invocation with Non-Standard svcr Argument
Suspicious wermgr Execution Outside System Directories via process_creation
Pivot detection · T1036.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.