CrashDump Disabled via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•18

Detects the disabling of crash dumps by modifying the 'CrashControl' registry key to set the 'CrashDumpEnabled' value to 0. This activity has been observed in malware like HermeticWiper to hinder forensic analysis.