Crash Dump Created By Operating System

Title: Crash Dump Created By Operating System
Status: experimental
Description:Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
References:
  -https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
  -https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
Author: Jason Mull
Date: 2025-05-12
modified:None
Tags:

• -'attack.credential-access'
• -'attack.collection'
• -'attack.t1003.002'
• -'attack.t1005'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
    EventID: '1001'
  condition:selection
Falsepositives:
Level: medium