Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder

Alerts on Visual Studio–staged dump64.exe masquerading, potentially indicating an attempt to bypass Windows Defender AV.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-11-26
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where an executable named dump64.exe is placed under a Microsoft Visual Studio directory within Program Files. It indicates possible attempt to masquerade dump64 functionality by renaming a tool to appear legitimate, which can help evade security controls. The detection relies on process image path patterns (starts/contains/ends) and, for matched tools, command-line characteristics such as procdump options for full or mini plus dumps.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

Suspicious Physical Memory Acquisition via WinPmem (via process_creation)

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

Suspicious LSASS Credential Access via PowerShell (via process_creation)

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

Suspicious ProcDump LSASS Memory Dump via process_creation

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Suspicious LSASS Memory Dump via Procdump Process Creation

Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspected-defender-av-bypass-by-renaming-dump64-exe-in--129966c9

title: "Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder"
id: 30cf5525-0aca-4359-aaef-f069c6633dc2
status: test
description: This rule flags Windows process creation where an executable named dump64.exe is placed under a Microsoft Visual Studio directory within Program Files. It indicates possible attempt to masquerade dump64 functionality by renaming a tool to appear legitimate, which can help evade security controls. The detection relies on process image path patterns (starts/contains/ends) and, for matched tools, command-line characteristics such as procdump options for full or mini plus dumps.
references:
  - https://twitter.com/mrd0x/status/1460597833917251595
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml
author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-11-26
modified: 2024-06-21
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_dump:
    Image|startswith: :\Program Files
    Image|contains: \Microsoft Visual Studio\
    Image|endswith: \dump64.exe
  selection_tools_procdump:
    - OriginalFileName: procdump
    - CommandLine|contains:
        - " -ma "
        - " -mp "
  condition: selection_dump and 1 of selection_tools_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 129966c9-de17-4334-a123-8b58172e664d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL