Windows Application Error: MsMpEng.exe Crash Involving mpengine.dll

Alerts on Windows Application Error EventID 1000 indicating a crash involving MsMpEng.exe and mpengine.dll.

FreeReviewedSigma · High · v2

Product: windows
Service: application
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-05-09
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1211Exploitation for Stealth
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Application Error events where the process MsMpEng.exe is reported crashing and the event data includes mpengine.dll. Such crashes can be leveraged to impair or disrupt Microsoft Malware Protection Engine functionality during an attack or after malicious activity. The detection relies on Windows Application log telemetry, specifically EventID 1000 with provider name Application Error and matching crash-related strings in the event data.

Reporting behind it

Related detections9 linkedT1211 — drag to rearrange

Suspicious Dell ControlVault DLL Load by Unexpected Process (ReVault)

Suspicious Vulnerable ASUS AsIO3.sys Driver Load

Suspicious Vulnerable Driver Load for BYOVD Abuse by DragonForce Ransomware (via driver_load)

Suspicious Staged Payload Execution from User Downloads or Pictures Folder

Malicious Vulnerable Driver Deployment for EDR Termination via file_event

Possible PAN-OS Auth Bypass via Double-Encoded Path Traversal to ztp_gate (CVE-2025-0108)

Malicious Bring-Your-Own-Vulnerable-Driver Load By BlackByte

Windows Process Command Lines Writing Malicious Files to C:\Windows\Fonts

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Windows Application Error: MsMpEng.exe Crash Involving mpengine.dll

Pivot detection · T1211 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-microsoft-malware-protection-engine-msmpeng-exe-crash-events-545a5da6

title: "Windows Application Error: MsMpEng.exe Crash Involving mpengine.dll"
id: 50a26fb5-1958-4942-95b2-806198e088e1
related:
  - id: 6c82cf5c-090d-4d57-9188-533577631108
    type: similar
  - id: 545a5da6-f103-4919-a519-e9aec1026ee4
    type: derived
status: test
description: This rule flags Windows Application Error events where the process MsMpEng.exe is reported crashing and the event data includes mpengine.dll. Such crashes can be leveraged to impair or disrupt Microsoft Malware Protection Engine functionality during an attack or after malicious activity. The detection relies on Windows Application log telemetry, specifically EventID 1000 with provider name Application Error and matching crash-related strings in the event data.
references:
  - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  - https://technet.microsoft.com/en-us/library/security/4022344
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-09
modified: 2023-04-14
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1211
  - attack.t1685
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    Data|contains|all:
      - MsMpEng.exe
      - mpengine.dll
  condition: selection
falsepositives:
  - MsMpEng might crash if the "C:\" partition is full
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL