huntrule

Windows WER BugCheck Crash Dump Reporting via Event ID 1001

Flags Windows WER SystemErrorReporting Event ID 1001 entries indicating a crash with bugcheck and dump/report details.

FreeReviewedSigma · Medium · v2
Product
windows
Service
system
Author
Jason Mull (SigmaHQ), DRL 1.1
Published
2025-05-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows SystemErrorReporting events from the WER provider that indicate a BugCheck crash and a subsequent system reboot. Attackers may trigger or leverage crashes to disrupt systems or stage activity, so capturing these crash indicators helps correlate instability with other suspicious behavior. The detection relies on Windows System event telemetry from the Microsoft-Windows-WER-SystemErrorReporting provider, matching Event ID 1001 and extracting fields such as the bugcheck code, dump file path, and report ID.

Reporting behind it

Related detections9 linkedT1005 — drag to rearrange
Suspicious Registry Hive Dump via reg save to Disguised evt Files
Malicious Velvet Ant Linux Backdoor and Credential Harvesting Artifacts (via file_event)
Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event
Suspicious Cryptocurrency Wallet File Access by Stealer (via process_creation)
Malicious NTDS Extraction from Volume Shadow Copy by RA World
Suspicious PAN-OS Running Config Staged as Web Content via CVE-2024-3400
Suspicious Infostealer Log Artifacts Written to Disk (via file_event)
Possible macOS TCC Bypass via mdimport Loading Custom Spotlight Importer
Malicious Flax Typhoon SAM and SECURITY Registry Hive Dump via reg save (via process_creation)
Windows WER BugCheck Crash Dump Reporting via Event ID 1001
Pivot detection · T1005 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.