Windows Process Tree: rundll32.exe launching wermgr.exe via DllRegisterServer
Flags rundll32.exe spawning wermgr.exe where rundll32 command line includes DllRegisterServer.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-11-26
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule detects a specific Windows process tree pattern where wermgr.exe is spawned by rundll32.exe with the parent command line containing DllRegisterServer. This behavior matters because it indicates executable registration or COM-related activity being used to run a component under a suspicious parent process. The detection relies on process creation telemetry including process image names, parent image names, and parent command-line content.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Tree: rundll32.exe launching wermgr.exe via DllRegisterServer"
id: 2263874e-6ac3-4a3c-8c0d-0982d0977061
related:
- id: c37510b8-2107-4b78-aa32-72f251e7a844
type: similar
- id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
type: derived
status: stable
description: This rule detects a specific Windows process tree pattern where wermgr.exe is spawned by rundll32.exe with the parent command line containing DllRegisterServer. This behavior matters because it indicates executable registration or COM-related activity being used to run a component under a suspicious parent process. The detection relies on process creation telemetry including process image names, parent image names, and parent command-line content.
references:
- https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20
- https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Malware/Trickbot/proc_creation_win_malware_trickbot_wermgr.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-11-26
modified: 2021-11-27
tags:
- attack.execution
- attack.t1559
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \wermgr.exe
ParentImage|endswith: \rundll32.exe
ParentCommandLine|contains: DllRegisterServer
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1