Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps

Flags renamed createdump.exe executions on Windows that use full dump flags and produce .dmp files.

FreeUnreviewedSigmahighv1

windows-process-creation-renamed-createdump-exe-used-for-dmp-memory-dumps-1a1ed54a

title: "Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps"
id: ef41bce0-6507-4eed-be22-0d4b6294ae9a
related:
  - id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
    type: similar
  - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
    type: derived
status: test
description: This rule flags Windows process creation events where the executable image ends with \createdump.exe but the file’s OriginalFileName metadata indicates it has been renamed. It matches command lines that include the createdump flags for full dumps (or equivalent short forms) along with a .dmp output target. Attackers may use this legitimate utility in a renamed form to evade simple allowlists while dumping sensitive process memory; the detection relies on process creation telemetry including Image path, OriginalFileName, and command-line arguments.
references:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://twitter.com/bopin2020/status/1366400799199272960
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-20
modified: 2023-02-14
tags:
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_creation
  product: windows
detection:
  selection_pe:
    OriginalFileName: FX_VER_INTERNALNAME_STR
  selection_cli:
    - CommandLine|contains|all:
        - " -u "
        - " -f "
        - .dmp
    - CommandLine|contains|all:
        - " --full "
        - " --name "
        - .dmp
  filter:
    Image|endswith: \createdump.exe
  condition: 1 of selection_* and not filter
falsepositives:
  - Command lines that use the same flags
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the executable image ends with \createdump.exe but the file’s OriginalFileName metadata indicates it has been renamed. It matches command lines that include the createdump flags for full dumps (or equivalent short forms) along with a .dmp output target. Attackers may use this legitimate utility in a renamed form to evade simple allowlists while dumping sensitive process memory; the detection relies on process creation telemetry including Image path, OriginalFileName, and command-line arguments.

Known false positives

Command lines that use the same flags

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.