Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder
Alerts on Visual Studio–staged dump64.exe masquerading, potentially indicating an attempt to bypass Windows Defender AV.
- Product
- windows
- Category
- process_creation
- Author
- Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-26
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where an executable named dump64.exe is placed under a Microsoft Visual Studio directory within Program Files. It indicates possible attempt to masquerade dump64 functionality by renaming a tool to appear legitimate, which can help evade security controls. The detection relies on process image path patterns (starts/contains/ends) and, for matched tools, command-line characteristics such as procdump options for full or mini plus dumps.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Dump64.EXE Renamed into Visual Studio Folder"
id: 30cf5525-0aca-4359-aaef-f069c6633dc2
status: test
description: This rule flags Windows process creation where an executable named dump64.exe is placed under a Microsoft Visual Studio directory within Program Files. It indicates possible attempt to masquerade dump64 functionality by renaming a tool to appear legitimate, which can help evade security controls. The detection relies on process image path patterns (starts/contains/ends) and, for matched tools, command-line characteristics such as procdump options for full or mini plus dumps.
references:
- https://twitter.com/mrd0x/status/1460597833917251595
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml
author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-11-26
modified: 2024-06-21
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: process_creation
detection:
selection_dump:
Image|startswith: :\Program Files
Image|contains: \Microsoft Visual Studio\
Image|endswith: \dump64.exe
selection_tools_procdump:
- OriginalFileName: procdump
- CommandLine|contains:
- " -ma "
- " -mp "
condition: selection_dump and 1 of selection_tools_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 129966c9-de17-4334-a123-8b58172e664d
type: derived