
title: Microsoft Malware Protection Engine Crash
author: Florian Roth
date: 2017/05/09
description: This rule detects a suspicious crash of the Microsoft Malware Protection
  Engine
detection:
  SELECTION_1:
    Provider_Name: Application Error
  SELECTION_2:
    EventID: 1000
  SELECTION_3:
    Provider_Name: Windows Error Reporting
  SELECTION_4:
    EventID: 1001
  SELECTION_5:
  - MsMpEng.exe
  SELECTION_6:
  - mpengine.dll
  condition: (((SELECTION_1 and SELECTION_2) or (SELECTION_3 and SELECTION_4)) and
    (SELECTION_5 and SELECTION_6))
falsepositives:
- MsMpEng.exe can crash when C:\ is full
id: 6c82cf5c-090d-4d57-9188-533577631108
level: high
logsource:
  product: windows
  service: application
modified: 2021/10/13
references:
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
- https://technet.microsoft.com/en-us/library/security/4022344
status: experimental
tags:
- attack.defense_evasion
- attack.t1089
- attack.t1211
- attack.t1562.001
ruletype: SIGMA
