Windows Suspicious Creation of .dmp/.hdmp Files by Shell or Script Hosts
Alerts on .dmp/.dump/.hdmp file creation by common Windows shells and scripting engines.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-07
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where a shell or scripting host process (cmd, cscript, mshta, powershell/pwsh, wscript) creates files ending in .dmp, .dump, or .hdmp. Memory dump files can expose sensitive data and may be created for collection or analysis beyond normal crash handling. The detection relies on Windows file event telemetry that includes the creating process image and the target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-suspicious-dmp-hdmp-file-creation-via-shell-or-scripting-aba15bdd
title: Windows Suspicious Creation of .dmp/.hdmp Files by Shell or Script Hosts
id: f61b07fd-9820-4a76-873d-7a2aaf929532
related:
- id: 3a525307-d100-48ae-b3b9-0964699d7f97
type: similar
- id: aba15bdd-657f-422a-bab3-ac2d2a0d6f1c
type: derived
status: test
description: This rule flags file creation events where a shell or scripting host process (cmd, cscript, mshta, powershell/pwsh, wscript) creates files ending in .dmp, .dump, or .hdmp. Memory dump files can expose sensitive data and may be created for collection or analysis beyond normal crash handling. The detection relies on Windows file event telemetry that includes the creating process image and the target filename.
references:
- https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dump_file_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-07
tags:
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
TargetFilename|endswith:
- .dmp
- .dump
- .hdmp
condition: selection
falsepositives:
- Some administrative PowerShell or VB scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive.
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/info.yml
license: DRL-1.1