detection.wiki

Detection rules › Sigma

Crash Dump Created By Operating System

Status
experimental
Severity
medium
Log source
product windows, service system
Author
Jason Mull
Source
github.com/SigmaHQ/sigma

Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

MITRE ATT&CK coverage

TacticTechniques
Credential Access
Collection

Telemetry coverage

ProviderRecord / event type
WER-SystemErrorReportingEvent ID 1001: The computer has rebooted from a bugcheck.

Rule body

title: Crash Dump Created By Operating System
id: 882fbe50-d8d7-4e29-ae80-0648a8556866
related:
    - id: 2ff692c2-4594-41ec-8fcb-46587de769e0
      type: similar
status: experimental
description: Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
references:
    - https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
    - https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
author: Jason Mull
date: 2025-05-12
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1003.002
    - attack.t1005
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
        EventID: 1001
    condition: selection
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
    EventID: 1001

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Provider_Nameeq
  • Microsoft-Windows-WER-SystemErrorReporting
field:"Provider_Name" kind:eq value:"Microsoft-Windows-WER-SystemErrorReporting"