Crash dump disabled on host (ASIM Version)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This detection looks the prevention of crash dumps being created. This can be used to limit reporting by malware, look for suspicious processes setting this registry key.

Attribute	Value
Type	Hunting Query
Solution	Standalone Content
ID	6cb193f3-7c6d-4b53-9153-49a09be830d7
Tactics	DefenseEvasion
Techniques	T1070
Source	[View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/ASimRegistry/Crashdumpdisabledonhost%28ASIMVersion%29.yaml)

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries