Windows System Crash Dump Reporting via WER Event ID 1001

Flags Windows WER SystemErrorReporting Event ID 1001 entries indicating a crash with bugcheck and dump/report details.

FreeUnreviewedSigmamediumv1

windows-system-crash-dump-reporting-via-wer-event-id-1001-882fbe50

title: Windows System Crash Dump Reporting via WER Event ID 1001
id: ba4b2e84-fa70-4cb5-9339-f655fcc2d275
related:
  - id: 2ff692c2-4594-41ec-8fcb-46587de769e0
    type: similar
  - id: 882fbe50-d8d7-4e29-ae80-0648a8556866
    type: derived
status: experimental
description: This rule catches Windows SystemErrorReporting events where the operating system reports a crash and initiates a reboot. Attackers can use crash dump generation and related artifacts to impact availability or facilitate follow-on analysis, so surfacing these events helps validate unusual system instability. It relies on Windows System channel telemetry from the Microsoft-Windows-WER-SystemErrorReporting provider, matching EventID 1001 records that include crash context such as bugcheck code, dump file path, and report ID.
references:
  - https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
  - https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/microsoft_windows_wer_systemerrorreporting/win_system_crash_dump_created.yml
author: Jason Mull, Huntrule Team
date: 2025-05-12
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1003.002
  - attack.t1005
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Microsoft-Windows-WER-SystemErrorReporting
    EventID: 1001
  condition: selection
level: medium
license: DRL-1.1

What it detects

This rule catches Windows SystemErrorReporting events where the operating system reports a crash and initiates a reboot. Attackers can use crash dump generation and related artifacts to impact availability or facilitate follow-on analysis, so surfacing these events helps validate unusual system instability. It relies on Windows System channel telemetry from the Microsoft-Windows-WER-SystemErrorReporting provider, matching EventID 1001 records that include crash context such as bugcheck code, dump file path, and report ID.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.