Query: rule covering This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Matching passage: Sigma rule: This rule detects a suspicious crash of the Microsoft Malware Protection Engine. Logsource: windows / application. Rule: title: Microsoft Malware Protection Engine Crash id: 545a5da6-f103-4919-a519-e9aec1026ee4 related: - id: 6c82cf5c-090d-4d57-9188-533577631108 type: similar status: test description: This rule detects a suspicious crash of the Microsoft Malware Protection Engine references: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 - https://technet.microsoft.com/en-us/library/security/4022344 author: Florian Roth (Nextron Systems) date: 2017-05-09 modified: 2023-04-14 tags: - attack.stealth - attack.defense-impairment - attack.t1211 - attack.t1685 logsource: product: windows service: application detection: selection: Provider_Name: Application Error EventID: 1000 Data|contains|all: - MsMpEng.exe - mpengine.dll condition: selection falsepositives: - MsMpEng might crash if the "C:\" partition is full level: high
Near-miss passage: Sigma rule: Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy executio. Logsource: windows / image_load. Rule: title: Unsigned DLL Loaded by Windows Utility id: b5de0c9a-6f19-43e0-af4e-55ad01f550af status: test description: 'Detects windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse those programs to proxy execution of malicious code. ' references: - https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion - https://akhere.hashnode.dev/hunting-unsigned-dlls-using-kql - https://unit42.paloaltonetworks.com/unsigned-dlls/?web_view=true author: Swachchhanda Shrawan Poudel date: 2024-02-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.011 - attack.t1218.010 logsource: product: windows category: image_load detection: selection: Image|endswith: - \InstallUtil.exe - \RegAsm.exe - \RegSvcs.exe - \regsvr32.exe - \rundll32.exe filter_main_signed: Signed: 'true' filter_main_sig_status: SignatureStatus: - errorChaining - errorCode_endpoint - errorExpired - trusted - Valid filter_main_signed_null: Signed: null filter_main_signed_empty: Signed: - '' - '-' filter_main_sig_status_null: SignatureStatus: null filter_main_sig_status_empty: SignatureStatus: - '' - '-' filter_main_windows_installer: Image: - C:\Windows\SysWOW64\rundll32.exe - C:\Windows\System32\rundll32.exe ImageLoaded|startswith: C:\Windows\Installer\ ImageLoaded|endswith: - .tmp-\Microsoft.Deployment.WindowsInstaller.dll - .tmp-\Avira.OE.Setup.CustomActions.dll filter_main_assembly: Image|startswith: - C:\Windows\SysWOW64\ - C:\Windows\System32\ - C:\Windows\Microsoft.NET\Framework64 Image|endswith: \RegAsm.exe ImageLoaded|endswith: .dll ImageLoaded|startswith: C:\Windows\assembly\NativeImages filter_optional_klite_codec: Image: - C:\Windows\SysWOW64\regsvr32.exe - C:\Windows\System32\regsvr32.exe ImageLoaded|startswith: - C:\Program Files (x86)\K-Lite Codec Pack\ - C:\Program Files\K-Lite Codec Pack\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium