Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender
Alerts on Windows processes launched with DumpStack.log in the image name and command-line output argument.
FreeReviewedSigma · Critical · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-06
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions where the launched image filename ends with DumpStack.log and where the command line includes the argument ' -o DumpStack.log'. Attackers may use this filename to evade Microsoft Defender behavior during execution. The detection relies on process creation telemetry, specifically the process image path and the full command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-dumpstack-log-used-to-evade-microsoft-defender-4f647cfa
title: "Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender"
id: 9304fdd7-06c8-41b4-b0ea-90159b417920
status: test
description: This rule flags Windows process executions where the launched image filename ends with DumpStack.log and where the command line includes the argument ' -o DumpStack.log'. Attackers may use this filename to evade Microsoft Defender behavior during execution. The detection relies on process creation telemetry, specifically the process image path and the full command line.
references:
- https://twitter.com/mrd0x/status/1479094189048713219
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-06
modified: 2022-06-17
tags:
- attack.defense-impairment
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \DumpStack.log
selection_download:
CommandLine|contains: " -o DumpStack.log"
condition: 1 of selection*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 4f647cfa-b598-4e12-ad69-c68dd16caef8
type: derived