Sysmon Application Crashed

Title: Sysmon Application Crashed
Status: test
Description:Detects application popup reporting a failure of the Sysmon service
References:
  -https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36
Author: Tim Shelton
Date: 2022-04-26
modified:2024-01-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• service: system

Detection:
  selection:
    Provider_Name: 'Application Popup'
    EventID: '26'
    Caption:
      -'sysmon64.exe - Application Error'
      -'sysmon.exe - Application Error'

  condition:selection
Falsepositives:
  -Unknown
Level: high