Windows: Dumpert Process Dumper Execution via Dumpert.dll or Known MD5

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of the Dumpert process dumper by matching a known Dumpert.dll string in the command line or a specific MD5 hash. Dumping process memory is commonly used to access credentials, including from lsass.exe. It relies on Windows process creation telemetry with command-line content and process image hash values.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows: Dumpert Process Dumper Execution via Dumpert.dll or Known MD5

Pivot detection · T1003.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hacktool-execution-dumpert-process-dumper-loading-dumpert-dll-2704ab9e

title: "Windows: Dumpert Process Dumper Execution via Dumpert.dll or Known MD5"
id: e8d0d804-a9a6-4e3f-b384-e37004fbca8a
status: test
description: This rule identifies execution of the Dumpert process dumper by matching a known Dumpert.dll string in the command line or a specific MD5 hash. Dumping process memory is commonly used to access credentials, including from lsass.exe. It relies on Windows process creation telemetry with command-line content and process image hash values.
references:
  - https://github.com/outflanknl/Dumpert
  - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-02-04
modified: 2025-01-22
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Hashes|contains: MD5=09D278F9DE118EF09163C6140255C690
    - CommandLine|contains: Dumpert.dll
  condition: selection
falsepositives:
  - Very unlikely
level: critical
license: DRL-1.1
related:
  - id: 2704ab9e-afe2-4854-a3b1-0c0706d03578
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL