Windows Registry: Disable CrashDump via CrashControl DWORD value

Alerts on registry changes that disable Windows crash dumps by writing 0x00000000 to CrashControl.

FreeUnreviewedSigmamediumv1

windows-registry-disable-crashdump-via-crashcontrol-dword-value-2ff692c2

title: "Windows Registry: Disable CrashDump via CrashControl DWORD value"
id: 7fb77613-ac90-4c4b-bc8c-7ac50c1bef20
status: test
description: This rule flags Windows registry modifications that disable CrashDump by setting a DWORD value (0x00000000) under SYSTEM\CurrentControlSet\Control\CrashControl. Disabling crash dumps can reduce available forensic artifacts and impair incident response after malicious activity. The detection relies on registry-set telemetry that records the TargetObject path and the changed Details value.
references:
  - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2022-02-24
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.stealth
  - attack.defense-impairment
  - attack.t1564
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: SYSTEM\CurrentControlSet\Control\CrashControl
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Legitimate disabling of crashdumps
level: medium
license: DRL-1.1
related:
  - id: 2ff692c2-4594-41ec-8fcb-46587de769e0
    type: derived

What it detects

This rule flags Windows registry modifications that disable CrashDump by setting a DWORD value (0x00000000) under SYSTEM\CurrentControlSet\Control\CrashControl. Disabling crash dumps can reduce available forensic artifacts and impair incident response after malicious activity. The detection relies on registry-set telemetry that records the TargetObject path and the changed Details value.

Known false positives

Legitimate disabling of crashdumps

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.