CrashControl CrashDump Disabled

Title: CrashControl CrashDump Disabled
Status: test
Description:Detects disabling the CrashDump per registry (as used by HermeticWiper)
References:
  -https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
Author: Tobias Michalski (Nextron Systems)
Date: 2022-02-24
modified:2023-08-17
Tags:

• -'attack.persistence'
• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1564'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|contains: 'SYSTEM\CurrentControlSet\Control\CrashControl'
    Details: 'DWORD (0x00000000)'
  condition:selection
Falsepositives:
  -Legitimate disabling of crashdumps
Level: medium