huntrule

Windows HackTool: Outflank Dumpert default dump file creation

Alerts on creation of Dumpert’s default "dumpert.dmp" dump file on Windows.

FreeUnreviewedSigmacriticalv1
title: "Windows HackTool: Outflank Dumpert default dump file creation"
id: 9791bdee-7410-45ed-9f91-2303fed72270
related:
  - id: 2704ab9e-afe2-4854-a3b1-0c0706d03578
    type: derived
  - id: 93d94efc-d7ad-4161-ad7d-1638c4f908d8
    type: derived
status: test
description: This rule flags creation of the default dump file used by the Outflank Dumpert process dumper (filename ending with "dumpert.dmp"). Attackers use memory dump files to extract sensitive credentials from process memory, making this file creation a high-signal behavior. It relies on Windows file event telemetry that records the target filename for the write/create operation.
references:
  - https://github.com/outflanknl/Dumpert
  - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_dumpert.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-02-04
modified: 2023-05-09
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: dumpert.dmp
  condition: selection
falsepositives:
  - Very unlikely
level: critical
license: DRL-1.1

What it detects

This rule flags creation of the default dump file used by the Outflank Dumpert process dumper (filename ending with "dumpert.dmp"). Attackers use memory dump files to extract sensitive credentials from process memory, making this file creation a high-signal behavior. It relies on Windows file event telemetry that records the target filename for the write/create operation.

Known false positives

  • Very unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.