Renamed CreateDump Utility Execution

calendar Jan 1, 2024 · attack.defense_evasion attack.t1036 attack.t1003.001  ·
Share on: linkedin copy

Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Sigma rule (View on GitHub)

 1title: Renamed CreateDump Utility Execution
 2id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
 3related:
 4    - id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
 5      type: similar
 6status: test
 7description: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
 8references:
 9    - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
10    - https://twitter.com/bopin2020/status/1366400799199272960
11author: Florian Roth (Nextron Systems)
12date: 2022/09/20
13modified: 2023/02/14
14tags:
15    - attack.defense_evasion
16    - attack.t1036
17    - attack.t1003.001
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection_pe:
23        OriginalFileName: 'FX_VER_INTERNALNAME_STR'
24    selection_cli:
25        - CommandLine|contains|all:
26              - ' -u ' # Short version of '--full'
27              - ' -f ' # Short version of '--name'
28              - '.dmp'
29        - CommandLine|contains|all:
30              - ' --full ' # Short version of '--full'
31              - ' --name ' # Short version of '--name'
32              - '.dmp'
33    filter:
34        Image|endswith: '\createdump.exe'
35    condition: 1 of selection_* and not filter
36falsepositives:
37    - Command lines that use the same flags
38level: high

References

Related rules

to-top