Windows: Microsoft Malware Protection Engine (MsMpEng.exe) crash events

Alerts on Windows Application Error EventID 1000 indicating a crash involving MsMpEng.exe and mpengine.dll.

FreeUnreviewedSigmahighv1

windows-microsoft-malware-protection-engine-msmpeng-exe-crash-events-545a5da6

title: "Windows: Microsoft Malware Protection Engine (MsMpEng.exe) crash events"
id: 50a26fb5-1958-4942-95b2-806198e088e1
related:
  - id: 6c82cf5c-090d-4d57-9188-533577631108
    type: similar
  - id: 545a5da6-f103-4919-a519-e9aec1026ee4
    type: derived
status: test
description: This rule flags Windows Application Error events where the event text contains both MsMpEng.exe and mpengine.dll, indicating a crash of the Microsoft Malware Protection Engine. Such failures can be relevant to attackers seeking to impair endpoint defenses or reduce detection reliability. The detection relies on Windows Application logs (EventID 1000) with provider name Application Error and event data text matches for the engine and DLL.
references:
  - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  - https://technet.microsoft.com/en-us/library/security/4022344
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-05-09
modified: 2023-04-14
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1211
  - attack.t1685
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: Application Error
    EventID: 1000
    Data|contains|all:
      - MsMpEng.exe
      - mpengine.dll
  condition: selection
falsepositives:
  - MsMpEng might crash if the "C:\" partition is full
level: high
license: DRL-1.1

What it detects

This rule flags Windows Application Error events where the event text contains both MsMpEng.exe and mpengine.dll, indicating a crash of the Microsoft Malware Protection Engine. Such failures can be relevant to attackers seeking to impair endpoint defenses or reduce detection reliability. The detection relies on Windows Application logs (EventID 1000) with provider name Application Error and event data text matches for the engine and DLL.

Known false positives

MsMpEng might crash if the "C:\" partition is full

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.