Suspicious Crash Dump Created By Operating System (via system)

title: Suspicious Crash Dump Created By Operating System (via system)
id: a28a5ac8-14ef-5aa7-b833-e1c53ef3113a
status: stable
description: This rule detects "BugCheck" errors suggesting the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
references:
    - https://attack.mitre.org/techniques/T1005/
    - https://attack.mitre.org/techniques/T1003/002/
    - https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
    - https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
author: Huntrule Team
date: 2026-01-22
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1003.002
    - attack.t1005
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
        EventID: 1001
    condition: selection
falsepositives:
    - Unknown
level: medium