Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps
Identifies Windows file creations of .dmp/.dump/.hdmp files that may indicate memory dump generation.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-07
- Updated
- 2026-07-31
What it detects
This rule identifies the creation of files ending with .dmp, .dump, or .hdmp on Windows. Attackers and legitimate software both may create these dump files, and they can expose sensitive in-memory data such as credentials. Detection relies on file creation telemetry that includes the target filename suffix.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-creation-of-dmp-hdmp-memory-dump-files-3a525307
title: Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps
id: 95961b38-0505-417a-b60e-7810e7f65bd0
status: test
description: This rule identifies the creation of files ending with .dmp, .dump, or .hdmp on Windows. Attackers and legitimate software both may create these dump files, and they can expose sensitive in-memory data such as credentials. Detection relies on file creation telemetry that includes the target filename suffix.
references:
- https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_dump_file_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-07
tags:
- detection.threat-hunting
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- .dmp
- .dump
- .hdmp
condition: selection
falsepositives:
- Likely during crashes of software
level: low
license: DRL-1.1
related:
- id: 3a525307-d100-48ae-b3b9-0964699d7f97
type: derived