Windows ProcDump renamed, copied or moved for stealth evasion

ATT&CK techniques

Defense Evasion → Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1036Masquerading
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where ProcDump activity results in renamed artifacts or dump files being moved/copied with changed names. Attackers may do this to evade simple detections and to control how sensitive memory dump files (e.g., LSASS-related) appear on disk. The detection relies on command-line substrings indicating copy/move actions and dump filename patterns associated with ProcDump output.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps

Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping

Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line

Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches

Windows Process Creation: createdump.exe Dumping Memory with Full and Name Flags

Windows Procdump Process Execution

Windows Process Memory Dump via comsvcs.dll using rundll32

Windows ProcDump Command Lines Targeting LSASS Memory Dumps

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Windows ProcDump renamed, copied or moved for stealth evasion

Pivot detection · T1003.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-procdump-renamed-copied-or-moved-for-stealth-evasion-79b06761

title: Windows ProcDump renamed, copied or moved for stealth evasion
id: f8221a27-8893-47eb-83a3-c65581432c09
status: test
description: This rule flags Windows process creation events where ProcDump activity results in renamed artifacts or dump files being moved/copied with changed names. Attackers may do this to evade simple detections and to control how sensitive memory dump files (e.g., LSASS-related) appear on disk. The detection relies on command-line substrings indicating copy/move actions and dump filename patterns associated with ProcDump output.
references:
  - https://twitter.com/mrd0x/status/1480785527901204481
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2023-05-09
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains:
      - copy procdump
      - move procdump
  selection_2:
    CommandLine|contains|all:
      - "copy "
      - ".dmp "
    CommandLine|contains:
      - 2.dmp
      - lsass
      - out.dmp
  selection_3:
    CommandLine|contains:
      - copy lsass.exe_
      - move lsass.exe_
  condition: 1 of selection_*
falsepositives:
  - False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming
level: high
license: DRL-1.1
related:
  - id: 79b06761-465f-4f88-9ef2-150e24d3d737
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL