Windows ProcDump renamed, copied or moved for stealth evasion

Alerts on ProcDump commands that copy/move or rename dump outputs, including LSASS dump filename patterns.

FreeUnreviewedSigmahighv1

windows-procdump-renamed-copied-or-moved-for-stealth-evasion-79b06761

title: Windows ProcDump renamed, copied or moved for stealth evasion
id: f8221a27-8893-47eb-83a3-c65581432c09
status: test
description: This rule flags Windows process creation events where ProcDump activity results in renamed artifacts or dump files being moved/copied with changed names. Attackers may do this to evade simple detections and to control how sensitive memory dump files (e.g., LSASS-related) appear on disk. The detection relies on command-line substrings indicating copy/move actions and dump filename patterns associated with ProcDump output.
references:
  - https://twitter.com/mrd0x/status/1480785527901204481
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-05-09
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains:
      - copy procdump
      - move procdump
  selection_2:
    CommandLine|contains|all:
      - "copy "
      - ".dmp "
    CommandLine|contains:
      - 2.dmp
      - lsass
      - out.dmp
  selection_3:
    CommandLine|contains:
      - copy lsass.exe_
      - move lsass.exe_
  condition: 1 of selection_*
falsepositives:
  - False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming
level: high
license: DRL-1.1
related:
  - id: 79b06761-465f-4f88-9ef2-150e24d3d737
    type: derived

What it detects

This rule flags Windows process creation events where ProcDump activity results in renamed artifacts or dump files being moved/copied with changed names. Attackers may do this to evade simple detections and to control how sensitive memory dump files (e.g., LSASS-related) appear on disk. The detection relies on command-line substrings indicating copy/move actions and dump filename patterns associated with ProcDump output.

Known false positives

False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.