Detectionmediumexperimental

Crash Dump Created By Operating System

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Jason MullCreated Mon May 12882fbe50-d8d7-4e29-ae80-0648a8556866windows

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection:
        Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
        EventID: 1001
    condition: selection

References

MITRE ATT&CK

Tactics

Techniques

Sub-techniques

Related Rules

CrashControl CrashDump Disabled

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

882fbe50-d8d7-4e29-ae80-0648a8556866

Status

experimental

Level

medium

Type

Detection

Created

Mon May 12

Author

Path

rules/windows/builtin/system/microsoft_windows_wer_systemerrorreporting/win_system_crash_dump_created.yml

Raw Tags

attack.credential-accessattack.collectionattack.t1003.002attack.t1005