Windows Process Creation: SecurityXploded PasswordDump.exe Execution

Alerts on Windows executions of SecurityXploded PasswordDump.exe based on process metadata and filename.

FreeReviewedSigma · Critical · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-12-19
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555Credentials from Password Stores
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows process creation events where the process metadata indicates the SecurityXploded publisher/company and the executed binary name ends with PasswordDump.exe. Attackers commonly use credential-dumping tools to obtain authentication material, making their execution a high-priority indicator. The detection relies on telemetry fields such as Company, Image path suffix, and OriginalFileName ending with PasswordDump.exe.

Reporting behind it

Related detections9 linkedT1555 — drag to rearrange

Suspicious ALPHA SPIDER Veeam Backup Credential Extraction (via process_creation)

Malicious User Files Dump via Network Share - DonPapi, Lazagne (via security)

Malicious User Application Credentials Dump via Network Share - DonPapi, Lazagne (via security)

Malicious Veeam Credential Theft via PowerShell (via ps_script)

Malicious Credential Harvesting via LaZagne (via process_creation)

Suspicious Credential Prompt Phishing via osascript (via process_creation)

Suspicious Credential Store Access for WinSCP and PuTTY via PowerShell (via ps_script)

Malicious Veeam Credential Extraction via sqlcmd Query (via process_creation)

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

Windows Process Creation: SecurityXploded PasswordDump.exe Execution

Pivot detection · T1555 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-securityxploded-passworddump-exe-execution-7679d464

title: "Windows Process Creation: SecurityXploded PasswordDump.exe Execution"
id: 440cb189-8286-4bc0-bfa7-9f9921bd4da7
status: stable
description: This rule matches Windows process creation events where the process metadata indicates the SecurityXploded publisher/company and the executed binary name ends with PasswordDump.exe. Attackers commonly use credential-dumping tools to obtain authentication material, making their execution a high-priority indicator. The detection relies on telemetry fields such as Company, Image path suffix, and OriginalFileName ending with PasswordDump.exe.
references:
  - https://securityxploded.com/
  - https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-12-19
modified: 2023-02-04
tags:
  - attack.credential-access
  - attack.t1555
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Company: SecurityXploded
    - Image|endswith: PasswordDump.exe
    - OriginalFileName|endswith: PasswordDump.exe
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 7679d464-4f74-45e2-9e01-ac66c5eb041a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL