Add Debugger Entry To Hangs Key For Persistence

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects when an attacker adds a new "Debugger" value to the "Hangs" key in the Windows Error Reporting (WER) registry path. This technique can be used to achieve persistence by registering a malicious debugger that will be invoked when an application crashes, allowing the attacker to execute arbitrary code.