Windows WinRAR Compression of .dmp/.dump Files via Command Line

title: Windows WinRAR Compression of .dmp/.dump Files via Command Line
id: 15093014-53c1-4214-a719-9841671e2577
related:
  - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7
    type: similar
  - id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
    type: derived
status: test
description: This rule identifies Windows process executions of WinRAR (rar.exe or winrar.exe) where the command line includes dump-related extensions such as .dmp, .dump, or .hdmp. Attackers may compress memory or credential dump outputs to reduce size and facilitate collection or exfiltration. Detection relies on Windows process creation telemetry including the executable path and the full command line content.
references:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2023-09-12
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \rar.exe
        - \winrar.exe
    - Description: Command line RAR
  selection_extension:
    CommandLine|contains:
      - .dmp
      - .dump
      - .hdmp
  condition: all of selection_*
falsepositives:
  - Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally
  - Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting
level: medium
license: DRL-1.1