Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)
Triggers on AV signatures matching PWS* or known credential-dumping tool strings indicating potential password theft activity.
- Category
- antivirus
- Author
- Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
- Published
- 2018-09-09
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags antivirus alerts whose signature indicates password dumper or credential-stealing activity, based on signature prefixes and specific tool-name substrings. Attackers use these tools to extract credentials from local systems, making this behavior critical for credential-access investigations even if the malware was blocked. The detection relies on antivirus alert telemetry containing the matched signature string (Signature).
Reporting behind it
- nextron-systems.comhttps://www.nextron-systems.com/?s=antivirus
- virustotal.comhttps://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
- virustotal.comhttps://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_password_dumper.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)
id: 5593cf64-accd-4114-b00a-14640ec23d6c
status: stable
description: This rule flags antivirus alerts whose signature indicates password dumper or credential-stealing activity, based on signature prefixes and specific tool-name substrings. Attackers use these tools to extract credentials from local systems, making this behavior critical for credential-access investigations even if the malware was blocked. The detection relies on antivirus alert telemetry containing the matched signature string (Signature).
references:
- https://www.nextron-systems.com/?s=antivirus
- https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
- https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
- https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_password_dumper.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-15
tags:
- attack.credential-access
- attack.t1003
- attack.t1558
- attack.t1003.001
- attack.t1003.002
logsource:
category: antivirus
detection:
selection:
- Signature|startswith: PWS
- Signature|contains:
- Certify
- DCSync
- Creddump
- DumpCreds
- DumpLsass
- DumpPert
- FormBook
- HTool/WCE
- Kekeo
- Lazagne
- LsassDump
- Lummast
- Mimikatz
- MultiDump
- Multiverze
- Nanodump
- NativeDump
- Outflank
- PShlSpy
- PSWTool
- PWCrack
- PWDump
- PWS.
- PWSX
- pypykatz
- Rubeus
- SafetyKatz
- SecurityTool
- SharpChrome
- SharpDPAPI
- SharpDump
- SharpKatz
- SharpS.
- ShpKatz
- Steal
- TrickDump
- wsass
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 78cc2dd2-7d20-4d32-93ff-057084c38b93
type: derived