Windows Error Reporting: MsMpEng.exe crash involving mpengine.dll (EventID 1001)

title: "Windows Error Reporting: MsMpEng.exe crash involving mpengine.dll (EventID 1001)"
id: 76b95b43-792f-4264-bb21-bdf2b9f4d9b8
status: test
description: This rule flags Windows Error Reporting events (EventID 1001) that indicate a crash involving MsMpEng.exe and mpengine.dll. Attackers may leverage defense-related components failing or being repeatedly crashed to reduce endpoint protections. The detection relies on Windows application log telemetry with Provider_Name set to Windows Error Reporting and event data containing both MsMpEng.exe and mpengine.dll.
references:
  - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  - https://technet.microsoft.com/en-us/library/security/4022344
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-09
modified: 2023-04-14
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1211
  - attack.t1685
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Windows Error Reporting
    EventID: 1001
    Data|contains|all:
      - MsMpEng.exe
      - mpengine.dll
  condition: selection
falsepositives:
  - MsMpEng might crash if the "C:\" partition is full
level: high
license: DRL-1.1
related:
  - id: 6c82cf5c-090d-4d57-9188-533577631108
    type: derived