Windows Process Memory Dump Tool Execution: dotnet-dump.exe Collect

Flags dotnet-dump.exe executions using the collect parameter, which may indicate memory dumping of sensitive processes.

FreeUnreviewedSigmamediumv1

windows-process-memory-dump-tool-execution-dotnet-dump-exe-collect-53d8d3e1

title: "Windows Process Memory Dump Tool Execution: dotnet-dump.exe Collect"
id: a4daaa48-8f2e-41e6-8756-dd910da1ae55
status: test
description: This rule detects execution of dotnet-dump when the command line includes the collect flag. The behavior can be used to create memory dumps of running processes, which may expose sensitive data from critical services if targeted. Telemetry relies on Windows process creation events capturing the executable name (dotnet-dump.exe or its original file name) and the command-line parameters.
references:
  - https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect
  - https://twitter.com/bohops/status/1635288066909966338
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-14
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \dotnet-dump.exe
    - OriginalFileName: dotnet-dump.dll
  selection_cli:
    CommandLine|contains: collect
  condition: all of selection_*
falsepositives:
  - Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated
level: medium
license: DRL-1.1
related:
  - id: 53d8d3e1-ca33-4012-adf3-e05a4d652e34
    type: derived

What it detects

This rule detects execution of dotnet-dump when the command line includes the collect flag. The behavior can be used to create memory dumps of running processes, which may expose sensitive data from critical services if targeted. Telemetry relies on Windows process creation events capturing the executable name (dotnet-dump.exe or its original file name) and the command-line parameters.

Known false positives

Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.