Windows WER BugCheck Crash Dump Reporting via Event ID 1001

Flags Windows WER SystemErrorReporting Event ID 1001 entries indicating a crash with bugcheck and dump/report details.

FreeReviewedSigma · Medium · v2

Product: windows
Service: system
Author: Jason Mull (SigmaHQ), DRL 1.1
Published: 2025-05-12
Updated: 2026-07-31

ATT&CK techniques

Cred Access → Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.002Security Account Manager
Discovery
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
Impact

What it detects

This rule flags Windows SystemErrorReporting events from the WER provider that indicate a BugCheck crash and a subsequent system reboot. Attackers may trigger or leverage crashes to disrupt systems or stage activity, so capturing these crash indicators helps correlate instability with other suspicious behavior. The detection relies on Windows System event telemetry from the Microsoft-Windows-WER-SystemErrorReporting provider, matching Event ID 1001 and extracting fields such as the bugcheck code, dump file path, and report ID.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Malicious Registry Hive Dump of SAM or SYSTEM via Reg Save (via process_creation)

Suspicious Astaroth Spambot Browser Profile Staging Directory (via file_event)

Malicious Credential Hive Copy from Volume Shadow Copy

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

Malicious Registry Hive Dump of SAM and SYSTEM via Reg Save (via process_creation)

Suspicious SAM Registry Hive Dump to Windows Temp by BianLian

Suspicious Browser and Wallet Credential Theft via JavaScript Stealer

Windows WER BugCheck Crash Dump Reporting via Event ID 1001

Pivot detection · T1003.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-system-crash-dump-reporting-via-wer-event-id-1001-882fbe50

title: Windows WER BugCheck Crash Dump Reporting via Event ID 1001
id: ba4b2e84-fa70-4cb5-9339-f655fcc2d275
related:
  - id: 2ff692c2-4594-41ec-8fcb-46587de769e0
    type: similar
  - id: 882fbe50-d8d7-4e29-ae80-0648a8556866
    type: derived
status: experimental
description: This rule flags Windows SystemErrorReporting events from the WER provider that indicate a BugCheck crash and a subsequent system reboot. Attackers may trigger or leverage crashes to disrupt systems or stage activity, so capturing these crash indicators helps correlate instability with other suspicious behavior. The detection relies on Windows System event telemetry from the Microsoft-Windows-WER-SystemErrorReporting provider, matching Event ID 1001 and extracting fields such as the bugcheck code, dump file path, and report ID.
references:
  - https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
  - https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_wer_systemerrorreporting/win_system_crash_dump_created.yml
author: Jason Mull, Huntrule Team
date: 2025-05-12
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1003.002
  - attack.t1005
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-WER-SystemErrorReporting
    EventID: 1001
  condition: selection
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL