Detects when a .wer (Windows Error Report) file is created in the Windows Error Reporting ReportQueue directory by a process other than the legitimate WER binaries (werfault.exe, werfaultsecure.exe, wermgr.exe). The rule relies on Sysmon EventID 11 (FileCreate) to catch file creations, filtering for file_name ending in .wer and file_path containing \ReportQueue\, while excluding common, legitimate WER processes. This behavior matches documented attack activity (e.g., ShieldBreak), where an attacker fabricates a .wer report and triggers the QueueReporting task so that wermgr.exe processes the report and loads a malicious DLL at SYSTEM integrity, enabling local privilege escalation. The detection aggregates results by destination, file path, file name, file hash, action, and associated process information (name, path, id, user, vendor_product). It uses helper macros to normalize timestamps and applies a custom filter to surface malicious activity. Intermediate findings highlight the suspicious process creating a Windows Error Reporting report and the corresponding path, while threat objects focus on the threatening process and the .wer file. The analytic story references RoguePlanet, Windows Privilege Escalation, and Windows Error Reporting Service Elevation of Privilege vulnerabilities to provide context. MITRE mappings include T1068 (Privilege Escalation) and T1053.005 (Scheduled Task: QueueReporting). To implement, ensure Sysmon is configured with EventID 11 FileCreate and that FileCreate targets include .wer or ReportQueue paths; be prepared to adjust for environment-specific legitimate crash-reporting components. Known false positives include crash-reporting or telemetry agents placing .wer files outside standard WER binaries; tuning by image path may be necessary. References provide additional context for related exploits and PoCs.