Microsoft Malware Protection Engine Crash

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects a suspicious crash of the Microsoft Malware Protection Engine (MsMpEng.exe) as indicated by an Application Error event (EventID 1000) containing both 'MsMpEng.exe' and 'mpengine.dll' in the event data. Such crashes could be indicative of an attempt to bypass or disable antivirus defenses, potentially through exploitation of vulnerabilities in the engine.