CreateDump Process Dump
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Sigma rule (View on GitHub)
1title: CreateDump Process Dump
2id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
3related:
4 - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
5 type: similar
6status: test
7description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory
8references:
9 - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
10 - https://twitter.com/bopin2020/status/1366400799199272960
11author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
12date: 2022-01-04
13modified: 2022-08-19
14tags:
15 - attack.defense-evasion
16 - attack.t1036
17 - attack.t1003.001
18 - attack.credential-access
19logsource:
20 category: process_creation
21 product: windows
22detection:
23 selection_img:
24 - Image|endswith: '\createdump.exe'
25 - OriginalFileName: 'FX_VER_INTERNALNAME_STR'
26 selection_cli:
27 CommandLine|contains:
28 - ' -u ' # Short version of '--full'
29 - ' --full '
30 - ' -f ' # Short version of '--name'
31 - ' --name '
32 - '.dmp '
33 condition: all of selection_*
34falsepositives:
35 - Command lines that use the same flags
36level: high
References
Related rules
- DumpMinitool Execution
- HackTool - XORDump Execution
- Potential SysInternals ProcDump Evasion
- Procdump Execution
- Renamed CreateDump Utility Execution