Windows Process Creation: createdump.exe used to dump process memory

Flags and .dmp output usage indicate createdump.exe dumping process memory on Windows.

FreeUnreviewedSigmahighv1

windows-process-creation-createdump-exe-used-to-dump-process-memory-515c8be5

title: "Windows Process Creation: createdump.exe used to dump process memory"
id: f28f79ec-c12b-487b-b94d-195a1bc1b728
related:
  - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
    type: similar
  - id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
    type: derived
status: test
description: This rule identifies process creation events where createdump.exe (FX_VER_INTERNALNAME_STR) is executed with command-line flags consistent with generating full process memory dump files (including .dmp output). Dumping process memory can expose sensitive data such as credentials and other in-memory secrets, making this behavior a common step in post-exploitation activity. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line arguments.
references:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://twitter.com/bopin2020/status/1366400799199272960
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2022-08-19
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \createdump.exe
    - OriginalFileName: FX_VER_INTERNALNAME_STR
  selection_cli:
    CommandLine|contains:
      - " -u "
      - " --full "
      - " -f "
      - " --name "
      - ".dmp "
  condition: all of selection_*
falsepositives:
  - Command lines that use the same flags
level: high
license: DRL-1.1

What it detects

This rule identifies process creation events where createdump.exe (FX_VER_INTERNALNAME_STR) is executed with command-line flags consistent with generating full process memory dump files (including .dmp output). Dumping process memory can expose sensitive data such as credentials and other in-memory secrets, making this behavior a common step in post-exploitation activity. The detection relies on Windows process creation telemetry, matching the executable name and specific command-line arguments.

Known false positives

Command lines that use the same flags

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.