Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps
Flags renamed createdump.exe executions on Windows that use full dump flags and produce .dmp files.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-20
- Updated
- 2026-07-30
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the executable image ends with \createdump.exe but the file’s OriginalFileName metadata indicates it has been renamed. It matches command lines that include the createdump flags for full dumps (or equivalent short forms) along with a .dmp output target. Attackers may use this legitimate utility in a renamed form to evade simple allowlists while dumping sensitive process memory; the detection relies on process creation telemetry including Image path, OriginalFileName, and command-line arguments.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
- twitter.comhttps://twitter.com/bopin2020/status/1366400799199272960
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps"
id: ef41bce0-6507-4eed-be22-0d4b6294ae9a
related:
- id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
type: similar
- id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
type: derived
status: test
description: This rule flags Windows process creation events where the executable image ends with \createdump.exe but the file’s OriginalFileName metadata indicates it has been renamed. It matches command lines that include the createdump flags for full dumps (or equivalent short forms) along with a .dmp output target. Attackers may use this legitimate utility in a renamed form to evade simple allowlists while dumping sensitive process memory; the detection relies on process creation telemetry including Image path, OriginalFileName, and command-line arguments.
references:
- https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
- https://twitter.com/bopin2020/status/1366400799199272960
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_createdump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-20
modified: 2023-02-14
tags:
- attack.stealth
- attack.t1036
- attack.t1003.001
- attack.credential-access
logsource:
category: process_creation
product: windows
detection:
selection_pe:
OriginalFileName: FX_VER_INTERNALNAME_STR
selection_cli:
- CommandLine|contains|all:
- " -u "
- " -f "
- .dmp
- CommandLine|contains|all:
- " --full "
- " --name "
- .dmp
filter:
Image|endswith: \createdump.exe
condition: 1 of selection_* and not filter
falsepositives:
- Command lines that use the same flags
level: high
license: DRL-1.1