Detectionmediumtest

CrashControl CrashDump Disabled

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Tobias MichalskiCreated Thu Feb 24Updated Thu Aug 172ff692c2-4594-41ec-8fcb-46587de769e0windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: 'SYSTEM\CurrentControlSet\Control\CrashControl'
        Details: 'DWORD (0x00000000)'
    condition: selection

False Positives

Legitimate disabling of crashdumps

References

Resolving title…

sentinelone.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0005 · Defense Evasion

Techniques

T1564 · Hide Artifacts T1112 · Modify Registry

Rule Metadata

Rule ID

2ff692c2-4594-41ec-8fcb-46587de769e0

Status

test

Level

medium

Type

Detection

Created

Thu Feb 24

Modified

Thu Aug 17

Author

Tobias Michalski

Path

rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml

Raw Tags

attack.persistenceattack.defense-evasionattack.t1564attack.t1112

View on GitHub