huntrule

Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender

Alerts on Windows processes launched with DumpStack.log in the image name and command-line output argument.

FreeUnreviewedSigmacriticalv1
title: "Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender"
id: 9304fdd7-06c8-41b4-b0ea-90159b417920
status: test
description: This rule flags Windows process executions where the launched image filename ends with DumpStack.log and where the command line includes the argument ' -o DumpStack.log'. Attackers may use this filename to evade Microsoft Defender behavior during execution. The detection relies on process creation telemetry, specifically the process image path and the full command line.
references:
  - https://twitter.com/mrd0x/status/1479094189048713219
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-06
modified: 2022-06-17
tags:
  - attack.defense-impairment
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \DumpStack.log
  selection_download:
    CommandLine|contains: " -o DumpStack.log"
  condition: 1 of selection*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 4f647cfa-b598-4e12-ad69-c68dd16caef8
    type: derived

What it detects

This rule flags Windows process executions where the launched image filename ends with DumpStack.log and where the command line includes the argument ' -o DumpStack.log'. Attackers may use this filename to evade Microsoft Defender behavior during execution. The detection relies on process creation telemetry, specifically the process image path and the full command line.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.