Crash Dump Created By Operating System — Sigma Rule

Rule metadata and linked tags

Author: Jason Mull. Source status: experimental; severity: medium. Source dates: 2025-05-12 / not supplied.

{
  "product": "windows",
  "service": "system"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: abf5d7bac3a4495f6b89736d77e98023b11cede94e3bef540dc8f5a34cb08b47

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Crash Dump Created By Operating System
id: 882fbe50-d8d7-4e29-ae80-0648a8556866
related:
    - id: 2ff692c2-4594-41ec-8fcb-46587de769e0
      type: similar
status: experimental
description: Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
references:
    - https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
    - https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
author: Jason Mull
date: 2025-05-12
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1003.002
    - attack.t1005
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
        EventID: 1001
    condition: selection
level: medium

Original YAML and metadata in JSON

False positives

No reviewed association in this snapshot.

Source references

• https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
• https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/