huntrule

Windows Suspicious Creation of .dmp/.hdmp Files by Shell or Script Hosts

Alerts on .dmp/.dump/.hdmp file creation by common Windows shells and scripting engines.

FreeReviewedSigma · Medium · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-09-07
Updated
2026-07-31
AnalysisDetection
title: Windows Suspicious Creation of .dmp/.hdmp Files by Shell or Script Hosts
id: f61b07fd-9820-4a76-873d-7a2aaf929532
related:
  - id: 3a525307-d100-48ae-b3b9-0964699d7f97
    type: similar
  - id: aba15bdd-657f-422a-bab3-ac2d2a0d6f1c
    type: derived
status: test
description: This rule flags file creation events where a shell or scripting host process (cmd, cscript, mshta, powershell/pwsh, wscript) creates files ending in .dmp, .dump, or .hdmp. Memory dump files can expose sensitive data and may be created for collection or analysis beyond normal crash handling. The detection relies on Windows file event telemetry that includes the creating process image and the target filename.
references:
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dump_file_susp_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-07
tags:
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    TargetFilename|endswith:
      - .dmp
      - .dump
      - .hdmp
  condition: selection
falsepositives:
  - Some administrative PowerShell or VB scripts might have the ability to collect dumps and move them to other folders which might trigger a false positive.
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_dump_file_susp_creation/info.yml
license: DRL-1.1