Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping
Identifies Windows executions of DumpMinitool.exe variants with dump options via process creation telemetry.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-06
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where DumpMinitool.exe (and its x86/arm64 variants) is launched. DumpMinitool can generate process memory dumps via MiniDumpWriteDump, which can support credential access and stealthy collection of sensitive data. It relies on telemetry that includes the process image name/path, OriginalFileName values, and command-line contents matching specific dumping-related flags.
Reporting behind it
- twitter.comhttps://twitter.com/mrd0x/status/1511415432888131586
- twitter.comhttps://twitter.com/mrd0x/status/1511489821247684615
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
- gist.github.comhttps://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping"
id: cdd8f977-f66a-4f90-883f-c1567a3fd009
status: test
description: This rule flags Windows process creation events where DumpMinitool.exe (and its x86/arm64 variants) is launched. DumpMinitool can generate process memory dumps via MiniDumpWriteDump, which can support credential access and stealthy collection of sensitive data. It relies on telemetry that includes the process image name/path, OriginalFileName values, and command-line contents matching specific dumping-related flags.
references:
- https://twitter.com/mrd0x/status/1511415432888131586
- https://twitter.com/mrd0x/status/1511489821247684615
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
- https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-06
modified: 2023-04-12
tags:
- attack.stealth
- attack.t1036
- attack.t1003.001
- attack.credential-access
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \DumpMinitool.exe
- \DumpMinitool.x86.exe
- \DumpMinitool.arm64.exe
- OriginalFileName:
- DumpMinitool.exe
- DumpMinitool.x86.exe
- DumpMinitool.arm64.exe
selection_cli:
CommandLine|contains:
- " Full"
- " Mini"
- " WithHeap"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: dee0a7a3-f200-4112-a99b-952196d81e42
type: derived