{"id":"4d7f1827-1637-4def-8d8a-fd254f9454df","title":"Sysmon Application Crashed","description":"Detects application popup reporting a failure of the Sysmon service","author":"Tim Shelton","status":"test","level":"high","date":"2022-04-26","modified":"2024-01-17","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","service":"system"},"falsepositives":["Unknown"],"references":["https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36"],"source_path":"rules/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml","source_sha256":"83993730946efb95e40d1110bb0bca14e7e59b3db2bd73c48e18f0d4888d1648","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Sysmon Application Crashed\nid: 4d7f1827-1637-4def-8d8a-fd254f9454df\nstatus: test\ndescription: Detects application popup reporting a failure of the Sysmon service\nreferences:\n    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36\nauthor: Tim Shelton\ndate: 2022-04-26\nmodified: 2024-01-17\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        Provider_Name: 'Application Popup'\n        EventID: 26\n        Caption:\n            - 'sysmon64.exe - Application Error'\n            - 'sysmon.exe - Application Error'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/4d7f1827-1637-4def-8d8a-fd254f9454df.json","kind":"sigma"}