Windows WinRAR Compression of .dmp/.dump Files via Command Line

Flags WinRAR executions on Windows whose command lines reference .dmp/.dump/.hdmp extensions.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-01-04
Updated: 2026-07-30

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions of WinRAR (rar.exe or winrar.exe) where the command line includes dump-related extensions such as .dmp, .dump, or .hdmp. Attackers may compress memory or credential dump outputs to reduce size and facilitate collection or exfiltration. Detection relies on Windows process creation telemetry including the executable path and the full command line content.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)

Suspicious Data Staging via Rar Archive With Delete Flag (via process_creation)

Suspicious 7za Archiver Executed from Windows Temp

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

Suspicious Oracle Data Export via sqluldr Utility by APT41 (via process_creation)

Suspicious Password Protected Archiving with Hardcoded GoSerpent Key via process_creation

Suspicious Multi-Volume RAR Archiving for Collection by EAGERBEE

Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)

Suspicious Selective Archiving via 7-Zip Linked to INC Ransomware Exfiltration

Windows WinRAR Compression of .dmp/.dump Files via Command Line

Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winrar-compression-of-dmp-dump-files-via-command-line-1ac14d38

title: Windows WinRAR Compression of .dmp/.dump Files via Command Line
id: 15093014-53c1-4214-a719-9841671e2577
related:
  - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7
    type: similar
  - id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
    type: derived
status: test
description: This rule identifies Windows process executions of WinRAR (rar.exe or winrar.exe) where the command line includes dump-related extensions such as .dmp, .dump, or .hdmp. Attackers may compress memory or credential dump outputs to reduce size and facilitate collection or exfiltration. Detection relies on Windows process creation telemetry including the executable path and the full command line content.
references:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2023-09-12
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \rar.exe
        - \winrar.exe
    - Description: Command line RAR
  selection_extension:
    CommandLine|contains:
      - .dmp
      - .dump
      - .hdmp
  condition: all of selection_*
falsepositives:
  - Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally
  - Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL