huntrule

Windows: QuarksPwDump.exe Credential Dumping via Command-Line Flags

Flags QuarksPwDump.exe executions on Windows that attempt local/domain hash and related data dumping.

FreeUnreviewedSigmahighv1
title: "Windows: QuarksPwDump.exe Credential Dumping via Command-Line Flags"
id: 78065405-26df-457c-a9e9-251f1c5e66b8
status: test
description: This rule identifies execution of QuarksPwDump.exe by matching specific command-line arguments associated with dumping local and domain cached hashes and extracting BitLocker/NTDS-related data. Credential dumping is a common attacker objective because it enables offline password cracking and can lead to further account compromise. The detection relies on Windows process creation telemetry, using the executable path ending with \QuarksPwDump.exe and the presence of the listed command-line flags.
references:
  - https://github.com/quarkslab/quarkspwdump
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-05
modified: 2023-02-05
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \QuarksPwDump.exe
  selection_cli:
    CommandLine:
      - " -dhl"
      - " --dump-hash-local"
      - " -dhdc"
      - " --dump-hash-domain-cached"
      - " --dump-bitlocker"
      - " -dhd "
      - " --dump-hash-domain "
      - --ntds-file
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0685b176-c816-4837-8e7b-1216f346636b
    type: derived

What it detects

This rule identifies execution of QuarksPwDump.exe by matching specific command-line arguments associated with dumping local and domain cached hashes and extracting BitLocker/NTDS-related data. Credential dumping is a common attacker objective because it enables offline password cracking and can lead to further account compromise. The detection relies on Windows process creation telemetry, using the executable path ending with \QuarksPwDump.exe and the presence of the listed command-line flags.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.