Windows Registry: Disable CrashDump via CrashControl DWORD value

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
- T1564Hide Artifacts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows registry modifications that disable CrashDump by setting a DWORD value (0x00000000) under SYSTEM\CurrentControlSet\Control\CrashControl. Disabling crash dumps can reduce available forensic artifacts and impair incident response after malicious activity. The detection relies on registry-set telemetry that records the TargetObject path and the changed Details value.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Suspicious Loopback Proxy Server Configured via Registry (via registry_set)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

Malicious Gh0stBins RAT Registry Marker HHClient

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

Windows Registry: Disable CrashDump via CrashControl DWORD value

Pivot detection · T1112 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-disable-crashdump-via-crashcontrol-dword-value-2ff692c2

title: "Windows Registry: Disable CrashDump via CrashControl DWORD value"
id: 7fb77613-ac90-4c4b-bc8c-7ac50c1bef20
status: test
description: This rule flags Windows registry modifications that disable CrashDump by setting a DWORD value (0x00000000) under SYSTEM\CurrentControlSet\Control\CrashControl. Disabling crash dumps can reduce available forensic artifacts and impair incident response after malicious activity. The detection relies on registry-set telemetry that records the TargetObject path and the changed Details value.
references:
  - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_crashdump_disabled.yml
author: Tobias Michalski (Nextron Systems), Huntrule Team
date: 2022-02-24
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.stealth
  - attack.defense-impairment
  - attack.t1564
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: SYSTEM\CurrentControlSet\Control\CrashControl
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Legitimate disabling of crashdumps
level: medium
license: DRL-1.1
related:
  - id: 2ff692c2-4594-41ec-8fcb-46587de769e0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL