Windows Process Creation: Suspected Defender AV Bypass by Renaming Dump64.EXE in Visual Studio

title: "Windows Process Creation: Suspected Defender AV Bypass by Renaming Dump64.EXE in Visual Studio"
id: 30cf5525-0aca-4359-aaef-f069c6633dc2
status: test
description: This rule flags process launches where an executable ending with dump64.exe is located under a Microsoft Visual Studio path and resides within Program Files, consistent with masquerading a tool as Dump64. Attackers may rename and stage binaries to evade security controls and improve execution of credential-access workflows. Detection relies on Windows process creation telemetry, matching the executable path and (when applicable) command-line indicators tied to specific tooling such as procdump.
references:
  - https://twitter.com/mrd0x/status/1460597833917251595
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml
author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-11-26
modified: 2024-06-21
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_dump:
    Image|startswith: :\Program Files
    Image|contains: \Microsoft Visual Studio\
    Image|endswith: \dump64.exe
  selection_tools_procdump:
    - OriginalFileName: procdump
    - CommandLine|contains:
        - " -ma "
        - " -mp "
  condition: selection_dump and 1 of selection_tools_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 129966c9-de17-4334-a123-8b58172e664d
    type: derived