CreateDump Process Dump

 1title: CreateDump Process Dump
 2id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
 3related:
 4    - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
 5      type: similar
 6status: test
 7description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory
 8references:
 9    - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
10    - https://twitter.com/bopin2020/status/1366400799199272960
11author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
12date: 2022/01/04
13modified: 2022/08/19
14tags:
15    - attack.defense_evasion
16    - attack.t1036
17    - attack.t1003.001
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection_img:
23        - Image|endswith: '\createdump.exe'
24        - OriginalFileName: 'FX_VER_INTERNALNAME_STR'
25    selection_cli:
26        CommandLine|contains:
27            - ' -u ' # Short version of '--full'
28            - ' --full '
29            - ' -f ' # Short version of '--name'
30            - ' --name '
31            - '.dmp '
32    condition: all of selection_*
33falsepositives:
34    - Command lines that use the same flags
35level: high

References

• AQUATIC PANDA in Possession of Log4Shell Exploit Tools | CrowdStrike

  

  CrowdStrike Falcon® OverWatch exposes AQUATIC PANDA in possession of Log4Shell exploit tools during hands-on intrusion attempt. Learn about the process here.

  
  Read More

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

Related rules

• Potential SysInternals ProcDump Evasion
• Password Protected ZIP File Opened (Suspicious Filenames)
• Process Access via TrolleyExpress Exclusion
• Sdiagnhost Calling Suspicious Child Process
• Suspicious Process Parents