CrashControl CrashDump Disabled

May 20, 2025 · attack.defense-evasion attack.t1564 attack.t1112 ·

Detects disabling the CrashDump per registry (as used by HermeticWiper)

Sigma rule (View on GitHub)

 1title: CrashControl CrashDump Disabled
 2id: 2ff692c2-4594-41ec-8fcb-46587de769e0
 3status: test
 4description: Detects disabling the CrashDump per registry (as used by HermeticWiper)
 5references:
 6    - https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
 7author: Tobias Michalski (Nextron Systems)
 8date: 2022-02-24
 9modified: 2023-08-17
10tags:
11    - attack.defense-evasion
12    - attack.t1564
13    - attack.t1112
14logsource:
15    product: windows
16    category: registry_set
17detection:
18    selection:
19        TargetObject|contains: 'SYSTEM\CurrentControlSet\Control\CrashControl'
20        Details: 'DWORD (0x00000000)'
21    condition: selection
22falsepositives:
23    - Legitimate disabling of crashdumps
24level: medium

References

HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

A new malware is attacking Ukrainian organizations and erasing Windows devices. In this early analysis, we provide technical details, IOCS and hunting rules.

Read More

CrashControl CrashDump Disabled

Sigma rule (View on GitHub)

References

HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

Related rules