Microsoft Malware Protection Engine Crash

Title: Microsoft Malware Protection Engine Crash
Status: test
Description:This rule detects a suspicious crash of the Microsoft Malware Protection Engine
References:
  -https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  -https://technet.microsoft.com/en-us/library/security/4022344
Author: Florian Roth (Nextron Systems)
Date: 2017-05-09
modified:2023-04-14
Tags:

• -'attack.stealth'
• -'attack.defense-impairment'
• -'attack.t1211'
• -'attack.t1685'

Logsource:

• product: windows
• service: application

Detection:
  selection:
    Provider_Name: 'Application Error'
    EventID: '1000'
    Data|contains|all:
      -'MsMpEng.exe'
      -'mpengine.dll'

  condition:selection
Falsepositives:
  -MsMpEng might crash if the "C:\" partition is full
Level: high