Windows: QuarksPwDump Credential Dump File Written to Temp SAM-*.dmp

title: "Windows: QuarksPwDump Credential Dump File Written to Temp SAM-*.dmp"
id: abf97c55-eb5a-4132-a9e5-0b4cf3cba331
status: test
description: This rule identifies Windows file creation events for dump files whose path and name match the pattern \AppData\Local\Temp\SAM-* and end with .dmp. Dumping SAM-related data to a local temporary directory is a common credential access tactic because it preserves sensitive information for offline extraction. The detection relies on file event telemetry that includes the target filename/path for newly created files.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-10
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \AppData\Local\Temp\SAM-
      - .dmp
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 847def9e-924d-4e90-b7c4-5f581395a2b4
    type: derived