huntrule

Antivirus Password Dumper Signature Match (PWS*)

Triggers on AV signatures matching PWS* or known credential-dumping tool strings indicating potential password theft activity.

FreeUnreviewedSigmacriticalv1
title: Antivirus Password Dumper Signature Match (PWS*)
id: 5593cf64-accd-4114-b00a-14640ec23d6c
status: stable
description: This rule flags antivirus alerts whose signature name starts with 'PWS' and/or contains known password-dumper and credential-stealing tool strings (e.g., Mimikatz, LSASS dumpers, Lazagne, PWDump). Such detections matter because password dumping and credential theft can directly enable account compromise, persistence, and lateral movement even if the malicious artifact was blocked. It relies on antivirus alert telemetry, specifically the reported signature field content.
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
  - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_password_dumper.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-15
tags:
  - attack.credential-access
  - attack.t1003
  - attack.t1558
  - attack.t1003.001
  - attack.t1003.002
logsource:
  category: antivirus
detection:
  selection:
    - Signature|startswith: PWS
    - Signature|contains:
        - Certify
        - DCSync
        - Creddump
        - DumpCreds
        - DumpLsass
        - DumpPert
        - FormBook
        - HTool/WCE
        - Kekeo
        - Lazagne
        - LsassDump
        - Lummast
        - Mimikatz
        - MultiDump
        - Multiverze
        - Nanodump
        - NativeDump
        - Outflank
        - PShlSpy
        - PSWTool
        - PWCrack
        - PWDump
        - PWS.
        - PWSX
        - pypykatz
        - Rubeus
        - SafetyKatz
        - SecurityTool
        - SharpChrome
        - SharpDPAPI
        - SharpDump
        - SharpKatz
        - SharpS.
        - ShpKatz
        - Steal
        - TrickDump
        - wsass
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 78cc2dd2-7d20-4d32-93ff-057084c38b93
    type: derived

What it detects

This rule flags antivirus alerts whose signature name starts with 'PWS' and/or contains known password-dumper and credential-stealing tool strings (e.g., Mimikatz, LSASS dumpers, Lazagne, PWDump). Such detections matter because password dumping and credential theft can directly enable account compromise, persistence, and lateral movement even if the malicious artifact was blocked. It relies on antivirus alert telemetry, specifically the reported signature field content.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.