[rule]
description = """
Identifies attempt to disable memory crashdump via registry modification. Malware using kernel mode component may
perform this action to limit exposure in the case of an unexpected system crash.
"""
id = "77ca3fcc-f607-45e0-837e-e4173e4ffc2a"
license = "Elastic License v2"
name = "CrashDump Disabled via Registry Modification"
os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper",
"https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options",
]
version = "1.0.31"
query = '''
registry where registry.value : "CrashDumpEnabled" and registry.data.strings : "0" and
process.executable != null and
not (user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe")) and
not process.executable : (
"?:\\Windows\\System32\\SystemPropertiesAdvanced.exe",
/* TBR */
"?:\\Program Files (x86)\\Citrix\\Workspace Environment Management Agent\\Citrix.Wem.Agent.Service.exe")
'''
min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"
[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[internal]
min_endpoint_version = "7.15.0"