Windows Sysmon Application Error Popups (Application Popup Event ID 26)

title: Windows Sysmon Application Error Popups (Application Popup Event ID 26)
id: aa68b28d-5ea3-4adb-b9a9-21f62d3547a2
status: test
description: This rule matches Windows System service events where an “Application Popup” reports an application error for sysmon64.exe or sysmon.exe with Event ID 26 and captions indicating “Application Error.” Such failures matter because they can disrupt telemetry collection and impair defense monitoring. The detection relies on System service logs capturing the Application Popup provider events and the associated error captions for the Sysmon binaries.
references:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml
author: Tim Shelton, Huntrule Team
date: 2022-04-26
modified: 2024-01-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Application Popup
    EventID: 26
    Caption:
      - sysmon64.exe - Application Error
      - sysmon.exe - Application Error
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4d7f1827-1637-4def-8d8a-fd254f9454df
    type: derived