Windows Procdump Process Execution

ATT&CK techniques

Defense Evasion → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executable path ends with procdump variants (procdump.exe, procdump64.exe, procdump64a.exe). Procdump is commonly used to capture process memory, which can be used to extract sensitive data and credentials from running processes. The detection relies on Windows process creation telemetry, specifically the process image name in each event.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange

Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps

Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping

Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line

Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches

Windows ProcDump renamed, copied or moved for stealth evasion

Windows Process Creation: createdump.exe Dumping Memory with Full and Name Flags

Windows Process Memory Dump via comsvcs.dll using rundll32

Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Malicious DLL Execution With Non Standard Extension via rundll32

Windows Procdump Process Execution

Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-procdump-process-execution-2e65275c

title: Windows Procdump Process Execution
id: f244f4ee-d32d-4994-8dc9-00791266324d
status: test
description: This rule flags process creation events where the executable path ends with procdump variants (procdump.exe, procdump64.exe, procdump64a.exe). Procdump is commonly used to capture process memory, which can be used to extract sensitive data and credentials from running processes. The detection relies on Windows process creation telemetry, specifically the process image name in each event.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-16
modified: 2026-06-29
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \procdump.exe
      - \procdump64.exe
      - \procdump64a.exe
  condition: selection
falsepositives:
  - Legitimate use of procdump by a developer or administrator
level: medium
license: DRL-1.1
related:
  - id: 2e65275c-8288-4ab4-aeb7-6274f58b6b20
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL