This analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process that runs at the SYSTEM integrity level. In normal Windows operation, WerMgr.exe runs under the integrity level of its launcher or as a background SYSTEM-owned service that does not spawn interactive children. The ShieldBreak exploit demonstrates WerMgr.exe being manually triggered via the QueueReporting scheduled task, which loads an attacker-controlled phantom DLL (phoneinfo.dll) and subsequently spawns an elevated shell. The rule correlates process creation events to identify a WerMgr.exe parent spawning a child process with SYSTEM integrity or user: System. It uses data from Sysmon (Process creation), Windows Security Event 4688 (process creation), and CrowdStrike ProcessRollup2 to confirm the chain. When a match is found, the rule outputs a finding such as: “The WerMgr.exe process spawned [child] running at SYSTEM integrity level on [dest]”. This activity indicates a successful local privilege escalation to SYSTEM and maps to MITRE ATT&CK techniques T1068 (Privilege Escalation) and T1134.001 (Access Token Manipulation). The rule is designed for endpoint detection and benefits from comprehensive process-creation logging and, if possible, Sysmon’s detailed child-process logging. Known false positives have not been identified; WerMgr spawning a SYSTEM-level child process is not expected under normal Windows Error Reporting operation. The rule complements other Windows privilege-escalation detections and helps rapidly identify post-exploitation attempts targeting SYSTEM access via WerMgr.)