Antivirus - Password Dumper Signature

calendar Jul 1, 2026 · attack.credential-access attack.t1003 attack.t1558 attack.t1003.001 attack.t1003.002  ·
Share on: linkedin copy

Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.

Sigma rule (View on GitHub)

 1title: Antivirus - Password Dumper Signature
 2id: 78cc2dd2-7d20-4d32-93ff-057084c38b93
 3status: stable
 4description: |
 5    Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
 6    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.    
 7references:
 8    - https://www.nextron-systems.com/?s=antivirus
 9    - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
10    - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
11author: Florian Roth (Nextron Systems), Arnim Rupp
12date: 2018-09-09
13modified: 2026-06-15
14tags:
15    - attack.credential-access
16    - attack.t1003
17    - attack.t1558
18    - attack.t1003.001
19    - attack.t1003.002
20logsource:
21    category: antivirus
22detection:
23    selection:
24        - Signature|startswith: 'PWS'
25        - Signature|contains:
26              - 'Certify'
27              - 'DCSync'
28              - 'Creddump'
29              - 'DumpCreds'
30              - 'DumpLsass'
31              - 'DumpPert'
32              - 'FormBook'
33              - 'HTool/WCE'
34              - 'Kekeo'
35              - 'Lazagne'
36              - 'LsassDump'
37              - 'Lummast'
38              - 'Mimikatz'
39              - 'MultiDump'
40              - 'Multiverze'
41              - 'Nanodump'
42              - 'NativeDump'
43              - 'Outflank'
44              - 'PShlSpy'
45              - 'PSWTool'
46              - 'PWCrack'
47              - 'PWDump'
48              - 'PWS.'
49              - 'PWSX'
50              - 'pypykatz'
51              - 'Rubeus'
52              - 'SafetyKatz'
53              - 'SecurityTool'
54              - 'SharpChrome'
55              - 'SharpDPAPI'
56              - 'SharpDump'
57              - 'SharpKatz'
58              - 'SharpS.' # Sharpsploit, e.g. 530ea2ff9049f5dfdfa0a2e9c27c2e3c0685eb6cbdf85370c20a7bfae49f592d
59              - 'ShpKatz'
60              - 'Steal'
61              - 'TrickDump'
62              - 'wsass'
63    condition: selection
64falsepositives:
65    - Unlikely
66level: critical

References

Related rules

to-top