huntrule

Windows Process Creation: SecurityXploded PasswordDump.exe Execution

Alerts on Windows executions of SecurityXploded PasswordDump.exe based on process metadata and filename.

FreeUnreviewedSigmacriticalv1
title: "Windows Process Creation: SecurityXploded PasswordDump.exe Execution"
id: 440cb189-8286-4bc0-bfa7-9f9921bd4da7
status: stable
description: This rule flags process creation events where the executable is identified as SecurityXploded and the filename matches PasswordDump.exe via both company metadata and process properties. Attackers may use credential-dumping tooling to extract passwords or hashes, so execution of known dumping binaries is a high-signal indicator. The detection relies on Windows process creation telemetry and fields such as Company, Image filename, and OriginalFileName ending in PasswordDump.exe.
references:
  - https://securityxploded.com/
  - https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-12-19
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1555
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Company: SecurityXploded
    - Image|endswith: PasswordDump.exe
    - OriginalFileName|endswith: PasswordDump.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 7679d464-4f74-45e2-9e01-ac66c5eb041a
    type: derived

What it detects

This rule flags process creation events where the executable is identified as SecurityXploded and the filename matches PasswordDump.exe via both company metadata and process properties. Attackers may use credential-dumping tooling to extract passwords or hashes, so execution of known dumping binaries is a high-signal indicator. The detection relies on Windows process creation telemetry and fields such as Company, Image filename, and OriginalFileName ending in PasswordDump.exe.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.