Windows Suspicious DMP/HDMP File Creation via Shell or Scripting

Alerts on .dmp/.dump/.hdmp file creation by common Windows shells and scripting engines.

FreeUnreviewedSigmamediumv1

windows-suspicious-dmp-hdmp-file-creation-via-shell-or-scripting-aba15bdd

title: Windows Suspicious DMP/HDMP File Creation via Shell or Scripting
id: f61b07fd-9820-4a76-873d-7a2aaf929532
related:
  - id: 3a525307-d100-48ae-b3b9-0964699d7f97
    type: similar
  - id: aba15bdd-657f-422a-bab3-ac2d2a0d6f1c
    type: derived
status: test
description: This rule flags creation of files ending in .dmp, .dump, or .hdmp when the creating process is a command or scripting host such as cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, or mshta.exe. Attackers may use crash dump-like files to stage or exfiltrate sensitive memory contents, or to blend activity with legitimate dump-collection behavior. It relies on Windows file event telemetry that records the process image path and the target filename extension involved in the file creation.
references:
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dump_file_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-07
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    TargetFilename|endswith:
      - .dmp
      - .dump
      - .hdmp
  condition: selection
falsepositives:
  - Some administrative PowerShell or VB scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive.
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/info.yml
license: DRL-1.1

What it detects

This rule flags creation of files ending in .dmp, .dump, or .hdmp when the creating process is a command or scripting host such as cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, or mshta.exe. Attackers may use crash dump-like files to stage or exfiltrate sensitive memory contents, or to blend activity with legitimate dump-collection behavior. It relies on Windows file event telemetry that records the process image path and the target filename extension involved in the file creation.

Known false positives

Some administrative PowerShell or VB scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.