Windows Error Reporting: MsMpEng.exe Crash with mpengine.dll

Alerts on WER EventID 1001 crashes where MsMpEng.exe and mpengine.dll appear in the event data.

FreeReviewedSigma · High · v2

Product: windows
Service: application
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-05-09
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1211Exploitation for Stealth
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Error Reporting events indicating a crash involving MsMpEng.exe and mpengine.dll. Attackers may leverage stability issues in security components to impair defenses, so unexpected crashes are operationally important to investigate. The detection relies on Windows Application logs (Provider_Name: Windows Error Reporting) with EventID 1001 and event data containing both process and module names.

Reporting behind it

Related detections9 linkedT1211 — drag to rearrange

Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)

Suspicious Vulnerable ASUS AsIO3.sys Driver Load

Suspicious Vulnerable Driver Load for BYOVD Abuse by DragonForce Ransomware (via driver_load)

Suspicious Staged Payload Execution from User Downloads or Pictures Folder

Malicious Vulnerable Driver Deployment for EDR Termination via file_event

Possible PAN-OS Auth Bypass via Double-Encoded Path Traversal to ztp_gate (CVE-2025-0108)

Malicious Bring-Your-Own-Vulnerable-Driver Load By BlackByte

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Windows Error Reporting: MsMpEng.exe Crash with mpengine.dll

Pivot detection · T1211 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-error-reporting-msmpeng-exe-crash-involving-mpengine-dll-eventid-1001-6c82cf5c

title: "Windows Error Reporting: MsMpEng.exe Crash with mpengine.dll"
id: 76b95b43-792f-4264-bb21-bdf2b9f4d9b8
status: test
description: "This rule flags Windows Error Reporting events indicating a crash involving MsMpEng.exe and mpengine.dll. Attackers may leverage stability issues in security components to impair defenses, so unexpected crashes are operationally important to investigate. The detection relies on Windows Application logs (Provider_Name: Windows Error Reporting) with EventID 1001 and event data containing both process and module names."
references:
  - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  - https://technet.microsoft.com/en-us/library/security/4022344
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-09
modified: 2023-04-14
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1211
  - attack.t1685
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Windows Error Reporting
    EventID: 1001
    Data|contains|all:
      - MsMpEng.exe
      - mpengine.dll
  condition: selection
falsepositives:
  - MsMpEng might crash if the "C:\" partition is full
level: high
license: DRL-1.1
related:
  - id: 6c82cf5c-090d-4d57-9188-533577631108
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL