Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key
Flags registry modifications adding a Debugger entry under Windows Error Reporting Hangs, a potential crash-triggered persistence technique.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule identifies changes to the Windows Registry where a new value path is set under the Windows Error Reporting Hangs key that includes a Debugger entry. Attackers may use this to establish persistence so their code is invoked when an application crashes. The detection relies on registry set telemetry that captures the target object path containing the specific Hangs\Debugger location.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/wer_debugger.html
- hexacorn.comhttps://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-add-debugger-value-under-windows-error-reporting-hangs-key-833ef470
title: "Windows Registry: Add Debugger Value Under Windows Error Reporting Hangs Key"
id: 7e4aeb38-0797-4c30-ad8b-0501bfa114d7
status: test
description: This rule identifies changes to the Windows Registry where a new value path is set under the Windows Error Reporting Hangs key that includes a Debugger entry. Attackers may use this to establish persistence so their code is invoked when an application crashes. The detection relies on registry set telemetry that captures the target object path containing the specific Hangs\Debugger location.
references:
- https://persistence-info.github.io/Data/wer_debugger.html
- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\Debugger
condition: selection
falsepositives:
- This value is not set by default but could be rarly used by administrators
level: high
license: DRL-1.1
related:
- id: 833ef470-fa01-4631-a79b-6f291c9ac498
type: derived