huntrule

Windows: File creation with credential-dump related filenames

Detects Windows file creation where the target filename contains or ends with known credential-dump tool or output names.

FreeUnreviewedSigmahighv1
title: "Windows: File creation with credential-dump related filenames"
id: 6f896860-050a-4135-91b4-56182c9256fa
status: test
description: This rule flags Windows file events where a newly created file matches well-known credential-dumping artifacts by filename patterns. Such artifacts are commonly produced by credential dump utilities or the files they generate, which can indicate credential access attempts or post-compromise data theft. It relies on file event telemetry with the target filename, matching both substring and filename ending patterns associated with common dumping tools and output files.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-11-01
modified: 2025-10-25
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.t1003.002
  - attack.t1003.003
  - attack.t1003.004
  - attack.t1003.005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    - TargetFilename|contains:
        - \fgdump-log
        - \kirbi
        - \pwdump
        - \pwhashes
        - \wce_ccache
        - \wce_krbtkts
    - TargetFilename|endswith:
        - \cachedump.exe
        - \cachedump64.exe
        - \DumpExt.dll
        - \DumpSvc.exe
        - \Dumpy.exe
        - \fgexec.exe
        - \lsremora.dll
        - \lsremora64.dll
        - \NTDS.out
        - \procdump.exe
        - \procdump64.exe
        - \procdump64a.exe
        - \pstgdump.exe
        - \pwdump.exe
        - \SAM.out
        - \SECURITY.out
        - \servpw.exe
        - \servpw64.exe
        - \SYSTEM.out
        - \test.pwd
        - \wceaux.dll
  condition: selection
falsepositives:
  - Legitimate Administrator using tool for password recovery
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files/info.yml
license: DRL-1.1
related:
  - id: 8fbf3271-1ef6-4e94-8210-03c2317947f6
    type: derived

What it detects

This rule flags Windows file events where a newly created file matches well-known credential-dumping artifacts by filename patterns. Such artifacts are commonly produced by credential dump utilities or the files they generate, which can indicate credential access attempts or post-compromise data theft. It relies on file event telemetry with the target filename, matching both substring and filename ending patterns associated with common dumping tools and output files.

Known false positives

  • Legitimate Administrator using tool for password recovery

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.