Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key

title: "Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key"
id: 7e4aeb38-0797-4c30-ad8b-0501bfa114d7
status: test
description: This rule identifies changes to the Windows Registry where a new value path is set under the Windows Error Reporting Hangs key that includes a Debugger entry. Attackers may use this to establish persistence so their code is invoked when an application crashes. The detection relies on registry set telemetry that captures the target object path containing the specific Hangs\Debugger location.
references:
  - https://persistence-info.github.io/Data/wer_debugger.html
  - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\Debugger
  condition: selection
falsepositives:
  - This value is not set by default but could be rarly used by administrators
level: high
license: DRL-1.1
related:
  - id: 833ef470-fa01-4631-a79b-6f291c9ac498
    type: derived