huntrule

Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)

Triggers on AV signatures matching PWS* or known credential-dumping tool strings indicating potential password theft activity.

FreeReviewedSigma · Critical · v5
Category
antivirus
Author
Florian Roth (Nextron Systems), Arnim Rupp (SigmaHQ), DRL 1.1
Published
2018-09-09
Updated
2026-07-31
AnalysisDetection
title: Antivirus Credential Dumping Signature Match (Password Dumpers/Stealers)
id: 5593cf64-accd-4114-b00a-14640ec23d6c
status: stable
description: This rule flags antivirus alerts whose signature indicates password dumper or credential-stealing activity, based on signature prefixes and specific tool-name substrings. Attackers use these tools to extract credentials from local systems, making this behavior critical for credential-access investigations even if the malware was blocked. The detection relies on antivirus alert telemetry containing the matched signature string (Signature).
references:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
  - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/antivirus/av_password_dumper.yml
author: Florian Roth (Nextron Systems), Arnim Rupp, Huntrule Team
date: 2018-09-09
modified: 2026-06-15
tags:
  - attack.credential-access
  - attack.t1003
  - attack.t1558
  - attack.t1003.001
  - attack.t1003.002
logsource:
  category: antivirus
detection:
  selection:
    - Signature|startswith: PWS
    - Signature|contains:
        - Certify
        - DCSync
        - Creddump
        - DumpCreds
        - DumpLsass
        - DumpPert
        - FormBook
        - HTool/WCE
        - Kekeo
        - Lazagne
        - LsassDump
        - Lummast
        - Mimikatz
        - MultiDump
        - Multiverze
        - Nanodump
        - NativeDump
        - Outflank
        - PShlSpy
        - PSWTool
        - PWCrack
        - PWDump
        - PWS.
        - PWSX
        - pypykatz
        - Rubeus
        - SafetyKatz
        - SecurityTool
        - SharpChrome
        - SharpDPAPI
        - SharpDump
        - SharpKatz
        - SharpS.
        - ShpKatz
        - Steal
        - TrickDump
        - wsass
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 78cc2dd2-7d20-4d32-93ff-057084c38b93
    type: derived