Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line
Alerts on suspicious command-line usage of DumpMinitool.exe on Windows, leveraging process creation Image, OriginalFileName, and command-line text.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-06
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions of DumpMinitool.exe and its architecture variants by matching the image name and original file name. It then flags likely suspicious usage patterns based on command-line content, including .txt output indicators and specific argument strings (" Full", " Mini", or " WithHeap"), while allowing exceptions for processes running from certain development and extension paths. Telemetry required is Windows process creation data with fields for the executable path, original file name, and full command line.
Reporting behind it
- twitter.comhttps://twitter.com/mrd0x/status/1511415432888131586
- twitter.comhttps://twitter.com/mrd0x/status/1511489821247684615
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line"
id: eb55d49f-b1fe-438b-9e4c-75c9284a725f
status: test
description: This rule identifies Windows process executions of DumpMinitool.exe and its architecture variants by matching the image name and original file name. It then flags likely suspicious usage patterns based on command-line content, including .txt output indicators and specific argument strings (" Full", " Mini", or " WithHeap"), while allowing exceptions for processes running from certain development and extension paths. Telemetry required is Windows process creation data with fields for the executable path, original file name, and full command line.
references:
- https://twitter.com/mrd0x/status/1511415432888131586
- https://twitter.com/mrd0x/status/1511489821247684615
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-06
modified: 2023-04-12
tags:
- attack.credential-access
- attack.stealth
- attack.t1036
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \DumpMinitool.exe
- \DumpMinitool.x86.exe
- \DumpMinitool.arm64.exe
- OriginalFileName:
- DumpMinitool.exe
- DumpMinitool.x86.exe
- DumpMinitool.arm64.exe
filter_folder:
Image|contains:
- \Microsoft Visual Studio\
- \Extensions\
susp_flags:
CommandLine|contains: .txt
cmd_has_flags:
CommandLine|contains:
- " Full"
- " Mini"
- " WithHeap"
filter_cmd_misses_flags:
CommandLine|contains: --dumpType
condition: selection and ( ( not filter_folder ) or susp_flags or ( cmd_has_flags and not filter_cmd_misses_flags ) )
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: eb1c4225-1c23-4241-8dd4-051389fde4ce
type: derived