Suspicious Winrar Compressing Dump Files (via process_creation)

title: Suspicious Winrar Compressing Dump Files (via process_creation)
id: 241d3393-1eb0-564e-8e01-d2c9305a64f2
status: stable
description: This rule detects execution of WinRAR to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
references:
    - https://attack.mitre.org/techniques/T1560/001/
    - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
author: Huntrule Team
date: 2026-03-17
tags:
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\rar.exe'
              - '\winrar.exe'
        - Description: 'Command line RAR'
    selection_extension:
        CommandLine|contains:
            - '.dmp'
            - '.dump'
            - '.hdmp'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium