Windows ProcDump Execution via Renamed Binary
Flags renamed ProcDump usage on Windows by matching procdump indicators and dump flags while excluding known executable names.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-11-18
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process executions where the binary’s OriginalFileName corresponds to procdump while the command line contains ProcDump dump-related flags and /accepteula. It also excludes common legitimate ProcDump filenames by filtering out process images ending with known procdump executables, focusing on renamed copies. Attackers and malware may rename ProcDump to evade security controls while still using familiar dumping options.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ProcDump Execution via Renamed Binary
id: 7259b39a-b0d4-4b21-a5a2-ab09cbed5dfc
related:
- id: 03795938-1387-481b-9f4c-3f6241e604fe
type: obsolete
- id: 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67
type: derived
status: test
description: This rule identifies Windows process executions where the binary’s OriginalFileName corresponds to procdump while the command line contains ProcDump dump-related flags and /accepteula. It also excludes common legitimate ProcDump filenames by filtering out process images ending with known procdump executables, focusing on renamed copies. Attackers and malware may rename ProcDump to evade security controls while still using familiar dumping options.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-11-18
modified: 2026-06-29
tags:
- attack.stealth
- attack.t1036.003
logsource:
product: windows
category: process_creation
detection:
selection_ofn:
OriginalFileName: procdump
selection_cli_dump_flag:
CommandLine|contains|windash:
- " -ma "
- " -mp "
selection_cli_eula_flag:
CommandLine|contains|windash: " /accepteula"
filter_main_known_names:
Image|endswith:
- \procdump.exe
- \procdump64.exe
- \procdump64a.exe
condition: (selection_ofn or all of selection_cli_*) and not 1 of filter_main_*
falsepositives:
- Procdump illegally bundled with legitimate software.
- Administrators who rename binaries (should be investigated).
level: high
license: DRL-1.1