Windows Process Dumping Using sqldumper.exe with Dump Options

Alerts on sqldumper.exe executions with command-line dump parameters indicative of process dumping.

FreeUnreviewedSigmamediumv1

windows-process-dumping-using-sqldumper-exe-with-dump-options-23ceaf5c

title: Windows Process Dumping Using sqldumper.exe with Dump Options
id: 2492ad2e-d9ba-40fc-92d2-4552b305432d
status: test
description: This rule flags Windows process executions of sqldumper.exe when the command line includes specific dump option values (0x0110 or 0x01100:40). Attackers can use a legitimate binary to capture process memory for credential theft or offline analysis, so correlating this behavior helps identify suspicious dump activity. The detection relies on process creation telemetry, specifically the executable path ending with sqldumper.exe and matching command-line contents.
references:
  - https://twitter.com/countuponsec/status/910977826853068800
  - https://twitter.com/countuponsec/status/910969424215232518
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml
author: Kirill Kiryanov, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sqldumper.exe
    CommandLine|contains:
      - "0x0110"
      - 0x01100:40
  condition: selection
falsepositives:
  - Legitimate MSSQL Server actions
level: medium
license: DRL-1.1
related:
  - id: 23ceaf5c-b6f1-4a32-8559-f2ff734be516
    type: derived

What it detects

This rule flags Windows process executions of sqldumper.exe when the command line includes specific dump option values (0x0110 or 0x01100:40). Attackers can use a legitimate binary to capture process memory for credential theft or offline analysis, so correlating this behavior helps identify suspicious dump activity. The detection relies on process creation telemetry, specifically the executable path ending with sqldumper.exe and matching command-line contents.

Known false positives

Legitimate MSSQL Server actions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.