Windows File Creation of .dmp/.hdmp Memory Dump Files

Identifies Windows file creations of .dmp/.dump/.hdmp files that may indicate memory dump generation.

FreeUnreviewedSigmalowv1

windows-file-creation-of-dmp-hdmp-memory-dump-files-3a525307

title: Windows File Creation of .dmp/.hdmp Memory Dump Files
id: 95961b38-0505-417a-b60e-7810e7f65bd0
status: test
description: This rule flags creation events for files ending in .dmp, .dump, or .hdmp on Windows. Attackers and legitimate software may generate these dump files, but memory dumps can expose sensitive data such as credentials if captured. The detection relies on file creation telemetry that includes the target filename.
references:
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_dump_file_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-07
tags:
  - detection.threat-hunting
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - .dmp
      - .dump
      - .hdmp
  condition: selection
falsepositives:
  - Likely during crashes of software
level: low
license: DRL-1.1
related:
  - id: 3a525307-d100-48ae-b3b9-0964699d7f97
    type: derived

What it detects

This rule flags creation events for files ending in .dmp, .dump, or .hdmp on Windows. Attackers and legitimate software may generate these dump files, but memory dumps can expose sensitive data such as credentials if captured. The detection relies on file creation telemetry that includes the target filename.

Known false positives

Likely during crashes of software

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.