Crashing Applications

Description

This query identifies crashing processes based on parameters passed to werfault.exe and attempts to find the associated process launch from DeviceProcessEvents.

Query · kql

DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ 'werfault.exe'
| project CrashTime = Timestamp, DeviceId, WerFaultCommand = ProcessCommandLine, CrashProcessId = extract("-p ([0-9]{1,5})", 1, ProcessCommandLine) 
| join kind= inner hint.strategy=shuffle DeviceProcessEvents on DeviceId
| where CrashProcessId == ProcessId and Timestamp between (datetime_add('day',-1,CrashTime) .. CrashTime)
| project-away ActionType
| project-rename ProcessStartTimestamp = Timestamp
Raw source Crashing Applications · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 53b250f6-c684-4932-aca9-a06045a962d6
name: Crashing Applications
description: |
  This query identifies crashing processes based on parameters passed
  to werfault.exe and attempts to find the associated process launch
  from DeviceProcessEvents.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Misconfiguration
query: |
  DeviceProcessEvents
  | where Timestamp > ago(1d)
  | where FileName =~ 'werfault.exe'
  | project CrashTime = Timestamp, DeviceId, WerFaultCommand = ProcessCommandLine, CrashProcessId = extract("-p ([0-9]{1,5})", 1, ProcessCommandLine) 
  | join kind= inner hint.strategy=shuffle DeviceProcessEvents on DeviceId
  | where CrashProcessId == ProcessId and Timestamp between (datetime_add('day',-1,CrashTime) .. CrashTime)
  | project-away ActionType
  | project-rename ProcessStartTimestamp = Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.