huntrule

Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps

Identifies Windows file creations of .dmp/.dump/.hdmp files that may indicate memory dump generation.

FreeReviewedSigma · Low · v5
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-09-07
Updated
2026-07-31
AnalysisDetection
title: Windows File Creation of .dmp/.hdmp/ .dump Crash Memory Dumps
id: 95961b38-0505-417a-b60e-7810e7f65bd0
status: test
description: This rule identifies the creation of files ending with .dmp, .dump, or .hdmp on Windows. Attackers and legitimate software both may create these dump files, and they can expose sensitive in-memory data such as credentials. Detection relies on file creation telemetry that includes the target filename suffix.
references:
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_dump_file_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-07
tags:
  - detection.threat-hunting
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - .dmp
      - .dump
      - .hdmp
  condition: selection
falsepositives:
  - Likely during crashes of software
level: low
license: DRL-1.1
related:
  - id: 3a525307-d100-48ae-b3b9-0964699d7f97
    type: derived