huntrule

Suspicious DumpMinitool.exe Execution on Windows

Alerts on suspicious command-line usage of DumpMinitool.exe on Windows, leveraging process creation Image, OriginalFileName, and command-line text.

FreeUnreviewedSigmahighv1
title: Suspicious DumpMinitool.exe Execution on Windows
id: eb55d49f-b1fe-438b-9e4c-75c9284a725f
status: test
description: This rule flags Windows process creation events where DumpMinitool.exe (x86 and arm64 variants) is executed from a path matching the binary name. The detection focuses on suspicious usage patterns indicated by command-line text such as '.txt' output and specific flags (e.g., ' Full', ' Mini', ' WithHeap'), while excluding executions under Microsoft Visual Studio/Extensions folders when possible. It relies on process creation telemetry, including Image path and OriginalFileName, and command-line contents to identify potentially credential-access and discovery-related dumping behavior.
references:
  - https://twitter.com/mrd0x/status/1511415432888131586
  - https://twitter.com/mrd0x/status/1511489821247684615
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-06
modified: 2023-04-12
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \DumpMinitool.exe
        - \DumpMinitool.x86.exe
        - \DumpMinitool.arm64.exe
    - OriginalFileName:
        - DumpMinitool.exe
        - DumpMinitool.x86.exe
        - DumpMinitool.arm64.exe
  filter_folder:
    Image|contains:
      - \Microsoft Visual Studio\
      - \Extensions\
  susp_flags:
    CommandLine|contains: .txt
  cmd_has_flags:
    CommandLine|contains:
      - " Full"
      - " Mini"
      - " WithHeap"
  filter_cmd_misses_flags:
    CommandLine|contains: --dumpType
  condition: selection and ( ( not filter_folder ) or susp_flags or ( cmd_has_flags and not filter_cmd_misses_flags ) )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: eb1c4225-1c23-4241-8dd4-051389fde4ce
    type: derived

What it detects

This rule flags Windows process creation events where DumpMinitool.exe (x86 and arm64 variants) is executed from a path matching the binary name. The detection focuses on suspicious usage patterns indicated by command-line text such as '.txt' output and specific flags (e.g., ' Full', ' Mini', ' WithHeap'), while excluding executions under Microsoft Visual Studio/Extensions folders when possible. It relies on process creation telemetry, including Image path and OriginalFileName, and command-line contents to identify potentially credential-access and discovery-related dumping behavior.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.