Windows ProcDump Execution via Renamed Binary

Flags renamed ProcDump usage on Windows by matching procdump indicators and dump flags while excluding known executable names.

FreeUnreviewedSigmahighv1

windows-procdump-execution-via-renamed-binary-4a0b2c7e

title: Windows ProcDump Execution via Renamed Binary
id: 7259b39a-b0d4-4b21-a5a2-ab09cbed5dfc
related:
  - id: 03795938-1387-481b-9f4c-3f6241e604fe
    type: obsolete
  - id: 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67
    type: derived
status: test
description: This rule identifies Windows process executions where the binary’s OriginalFileName corresponds to procdump while the command line contains ProcDump dump-related flags and /accepteula. It also excludes common legitimate ProcDump filenames by filtering out process images ending with known procdump executables, focusing on renamed copies. Attackers and malware may rename ProcDump to evade security controls while still using familiar dumping options.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-11-18
modified: 2026-06-29
tags:
  - attack.stealth
  - attack.t1036.003
logsource:
  product: windows
  category: process_creation
detection:
  selection_ofn:
    OriginalFileName: procdump
  selection_cli_dump_flag:
    CommandLine|contains|windash:
      - " -ma "
      - " -mp "
  selection_cli_eula_flag:
    CommandLine|contains|windash: " /accepteula"
  filter_main_known_names:
    Image|endswith:
      - \procdump.exe
      - \procdump64.exe
      - \procdump64a.exe
  condition: (selection_ofn or all of selection_cli_*) and not 1 of filter_main_*
falsepositives:
  - Procdump illegally bundled with legitimate software.
  - Administrators who rename binaries (should be investigated).
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process executions where the binary’s OriginalFileName corresponds to procdump while the command line contains ProcDump dump-related flags and /accepteula. It also excludes common legitimate ProcDump filenames by filtering out process images ending with known procdump executables, focusing on renamed copies. Attackers and malware may rename ProcDump to evade security controls while still using familiar dumping options.

Known false positives

Procdump illegally bundled with legitimate software.
Administrators who rename binaries (should be investigated).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.