Windows process execution: wermgr.exe running outside standard system directories
Alerts when wermgr.exe is launched from a non-standard directory on Windows.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-14
- Updated
- 2026-07-30
What it detects
This rule flags executions of wermgr.exe when the image path does not begin with typical Windows system locations. Attackers may abuse legitimate binaries by running them from unusual directories to evade basic allowlists. The detection relies on process creation telemetry, specifically the created process image path and its directory prefix.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
- echotrail.iohttps://www.echotrail.io/insights/search/wermgr.exe
- github.comhttps://github.com/binderlabs/DirCreate2System
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-execution-wermgr-exe-running-outside-standard-system-directories-5394fcc7
title: "Windows process execution: wermgr.exe running outside standard system directories"
id: c63b7aaa-86f8-4d3a-8294-f2d5e1c89288
related:
- id: 396f6630-f3ac-44e3-bfc8-1b161bc00c4e
type: similar
- id: 5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5
type: derived
status: test
description: This rule flags executions of wermgr.exe when the image path does not begin with typical Windows system locations. Attackers may abuse legitimate binaries by running them from unusual directories to evade basic allowlists. The detection relies on process creation telemetry, specifically the created process image path and its directory prefix.
references:
- https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
- https://www.echotrail.io/insights/search/wermgr.exe
- https://github.com/binderlabs/DirCreate2System
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-10-14
modified: 2023-08-23
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \wermgr.exe
filter_main_legit_location:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1