Skip to content
Threat Feed
Subscribe

Product

Windows Error Reporting

3 briefs RSS
medium threat

ShieldBreak Local Privilege Escalation via Windows Error Reporting

The ShieldBreak exploit facilitates local privilege escalation by manually creating malicious .wer files in the Windows Error Reporting ReportQueue directory to achieve arbitrary code execution as SYSTEM.

exploited Windows Error Reporting
1r 2t
medium advisory

LSASS Credential Dumping via Windows Error Reporting (WER) Abuse

Attackers can enable full user-mode dumps system-wide via registry modification to facilitate LSASS credential dumping, allowing extraction of credentials from process memory without deploying malware.

Elastic Defend +2 credential-access windows lsass wepw
2r 2t
medium advisory

Potential Windows Error Manager Masquerading

Adversaries may masquerade malicious processes as legitimate Windows Error Reporting processes (WerFault.exe or Wermgr.exe) to evade detection by establishing network connections without arguments, thus blending into normal system activity.

Windows Error Reporting defense-evasion masquerading windows
2r 1t