{"id":"545a5da6-f103-4919-a519-e9aec1026ee4","title":"Microsoft Malware Protection Engine Crash","description":"This rule detects a suspicious crash of the Microsoft Malware Protection Engine","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-05-09","modified":"2023-04-14","tags":["attack.stealth","attack.defense-impairment","attack.t1211","attack.t1685"],"technique_ids":["T1211","T1685"],"logsource":{"product":"windows","service":"application"},"falsepositives":["MsMpEng might crash if the \"C:\\\" partition is full"],"references":["https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5","https://technet.microsoft.com/en-us/library/security/4022344"],"source_path":"rules/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml","source_sha256":"e4416c99d570bb744da572186a2a31aa69b4abb360657651969bfdc8a0e2e744","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Microsoft Malware Protection Engine Crash\nid: 545a5da6-f103-4919-a519-e9aec1026ee4\nrelated:\n    - id: 6c82cf5c-090d-4d57-9188-533577631108\n      type: similar\nstatus: test\ndescription: This rule detects a suspicious crash of the Microsoft Malware Protection Engine\nreferences:\n    - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5\n    - https://technet.microsoft.com/en-us/library/security/4022344\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-05-09\nmodified: 2023-04-14\ntags:\n    - attack.stealth\n    - attack.defense-impairment\n    - attack.t1211\n    - attack.t1685\nlogsource:\n    product: windows\n    service: application\n    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly\ndetection:\n    selection:\n        Provider_Name: 'Application Error'\n        EventID: 1000\n        Data|contains|all:\n            - 'MsMpEng.exe'\n            - 'mpengine.dll'\n    condition: selection\nfalsepositives:\n    - MsMpEng might crash if the \"C:\\\" partition is full\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1211","id":"T1211","name":"Exploitation for Stealth","page":"techniques/enterprise/T1211/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/545a5da6-f103-4919-a519-e9aec1026ee4.json","kind":"sigma"}