splunk_escuTTP

Windows Wermgr Spawning System Integrity Process

The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level. WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children. In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell. If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.

Detection Query

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

from datamodel=Endpoint.Processes where

Processes.parent_process_name="WerMgr.exe"
(
    Processes.process_integrity_level="System"
    OR
    Processes.user IN ("*$", "System")
)

by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path
   Processes.parent_process Processes.parent_process_id Processes.process_name
   Processes.process_path Processes.process Processes.process_id Processes.process_hash
   Processes.process_integrity_level Processes.user Processes.vendor_product

| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_wermgr_spawning_system_integrity_process_filter`

Author

Onur Mustafa Erdogan, Splunk

Data Sources

Sysmon EventID 1Windows Event Log Security 4688CrowdStrike ProcessRollup2

References

Raw Content

name: Windows Wermgr Spawning System Integrity Process
id: d39634c8-7ce7-4503-a5da-73ca3c758fb9
version: 1
creation_date: '2026-08-17'
modification_date: '2026-08-18'
author: Onur Mustafa Erdogan, Splunk
status: production
type: TTP
description: |-
    The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.
    WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
    In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
    If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.parent_process_name="WerMgr.exe"
    (
        Processes.process_integrity_level="System"
        OR
        Processes.user IN ("*$", "System")
    )

    by Processes.action Processes.dest Processes.parent_process_name Processes.parent_process_path
       Processes.parent_process Processes.parent_process_id Processes.process_name
       Processes.process_path Processes.process Processes.process_id Processes.process_hash
       Processes.process_integrity_level Processes.user Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_wermgr_spawning_system_integrity_process_filter`
how_to_implement: |-
    This detection is based on Process creation events. Make sure you are ingesting logs that contain parent process details and fields that indicate privilege level, such as user name or integrity level. If you are using Sysmon, make sure to enable logging of child processes of WerMgr.exe.
known_false_positives: |-
    No false positives have been identified at this time.
    WerMgr.exe spawning a SYSTEM-integrity child process is not expected under normal Windows Error Reporting operation.
references:
    - https://www.cyderes.com/howler-cell/rogueplanet-windows-zero-day
    - https://www.threatlocker.com/blog/nightmareeclipse-releases-new-poc-shieldbreak-exploits-same-weakness-as-rogueplanet
    - https://isc.sans.edu/diary/22536
drilldown_searches:
    - name: View the detection results for - "$dest$" and "$user$"
      search: '%original_detection_search% | search  dest = "$dest$" user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$" and "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
finding:
    title: The [$parent_process_name$] process spawned [$process_name$] running at SYSTEM integrity level on $dest$
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: process
      type: process
    - field: process_name
      type: process_name
analytic_story:
    - RoguePlanet
    - Windows Privilege Escalation
    - Windows Error Reporting Service Elevation of Privilege Vulnerability
asset_type: Endpoint
mitre_attack_id:
    - T1068
    - T1134.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/emerging_threats/ShieldBreak/system_integrity_process.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit