Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\SAM-*

Flags creation of QuarksPwDump .dmp dump files in Temp with a SAM-* filename pattern.

FreeReviewedSigma · Critical · v2

Product: windows
Category: file_event
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-02-10
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.002Security Account Manager
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows file create events where the target filename contains both a Temp path starting with \AppData\Local\Temp\SAM- and ends with .dmp. Dump files are commonly used by credential-access tooling to extract sensitive data from memory or processes. It relies on file event telemetry that records the full or partial target filename for newly created files.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Suspicious Registry Hive Dump via reg save to Disguised evt Files

Malicious NTDS Extraction from Volume Shadow Copy by RA World

Malicious Flax Typhoon SAM and SECURITY Registry Hive Dump via reg save (via process_creation)

Malicious Registry Hive Dump for Credential Access via reg save (via process_creation)

Suspicious Registry Hive Export of SAM and SECURITY for Credential Theft after FortiClient EMS Exploitation

Malicious Registry Hive Dump via reg save

Malicious SAM and SYSTEM Registry Hive Credential Dump via reg.exe (via process_creation)

Malicious Registry Hive Theft from Shadow Copy via Print LOLBIN

Malicious Volume Shadow Copy Access via Mklink to GLOBALROOT

Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\SAM-*

Pivot detection · T1003.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-quarkspwdump-credential-dump-file-written-to-temp-sam-dmp-847def9e

title: "Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\\SAM-*"
id: abf97c55-eb5a-4132-a9e5-0b4cf3cba331
status: test
description: This rule matches Windows file create events where the target filename contains both a Temp path starting with \AppData\Local\Temp\SAM- and ends with .dmp. Dump files are commonly used by credential-access tooling to extract sensitive data from memory or processes. It relies on file event telemetry that records the full or partial target filename for newly created files.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-10
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \AppData\Local\Temp\SAM-
      - .dmp
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 847def9e-924d-4e90-b7c4-5f581395a2b4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL