Windows Process Creation: DumpMinitool.exe Memory Dump Tool Execution

title: "Windows Process Creation: DumpMinitool.exe Memory Dump Tool Execution"
id: cdd8f977-f66a-4f90-883f-c1567a3fd009
status: test
description: This rule flags execution of DumpMinitool binaries (DumpMinitool.exe and architecture-specific variants) based on process image path ending and matching original file names. DumpMinitool can create process memory dumps using MiniDumpWriteDump, which attackers may use to extract credentials or sensitive data from running processes. It relies on Windows process creation telemetry including Image and OriginalFileName, and uses CommandLine substrings (" Full", " Mini", " WithHeap") to narrow matches.
references:
  - https://twitter.com/mrd0x/status/1511415432888131586
  - https://twitter.com/mrd0x/status/1511489821247684615
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
  - https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-06
modified: 2023-04-12
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \DumpMinitool.exe
        - \DumpMinitool.x86.exe
        - \DumpMinitool.arm64.exe
    - OriginalFileName:
        - DumpMinitool.exe
        - DumpMinitool.x86.exe
        - DumpMinitool.arm64.exe
  selection_cli:
    CommandLine|contains:
      - " Full"
      - " Mini"
      - " WithHeap"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: dee0a7a3-f200-4112-a99b-952196d81e42
    type: derived