Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\SAM-*

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.002Security Account Manager
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows file create events where the target filename contains both a Temp path starting with \AppData\Local\Temp\SAM- and ends with .dmp. Dump files are commonly used by credential-access tooling to extract sensitive data from memory or processes. It relies on file event telemetry that records the full or partial target filename for newly created files.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Malicious Registry Hive Dump of SAM or SYSTEM via Reg Save (via process_creation)

Malicious Credential Hive Copy from Volume Shadow Copy

Malicious Secretdump Password Dumping via SMB Admin Share (via security)

Malicious Registry Hive Dump of SAM and SYSTEM via Reg Save (via process_creation)

Suspicious SAM Registry Hive Dump to Windows Temp by BianLian

Malicious SAM and SYSTEM Hive Dump via reg save (via process_creation)

Malicious Mimikatz Credential Access Module Invocation

Malicious SYSTEM Registry Hive Dump via reg.exe by Sandworm

Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\SAM-*

Pivot detection · T1003.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-quarkspwdump-credential-dump-file-written-to-temp-sam-dmp-847def9e

title: "Windows File Creation: QuarksPwDump Credential Dump (.dmp) in Temp\\SAM-*"
id: abf97c55-eb5a-4132-a9e5-0b4cf3cba331
status: test
description: This rule matches Windows file create events where the target filename contains both a Temp path starting with \AppData\Local\Temp\SAM- and ends with .dmp. Dump files are commonly used by credential-access tooling to extract sensitive data from memory or processes. It relies on file event telemetry that records the full or partial target filename for newly created files.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-02-10
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains|all:
      - \AppData\Local\Temp\SAM-
      - .dmp
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 847def9e-924d-4e90-b7c4-5f581395a2b4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL