Windows WinRAR Compression of .dmp/.dump Files via Command Line

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions of WinRAR (rar.exe or winrar.exe) where the command line includes dump-related extensions such as .dmp, .dump, or .hdmp. Attackers may compress memory or credential dump outputs to reduce size and facilitate collection or exfiltration. Detection relies on Windows process creation telemetry including the executable path and the full command line content.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Linux Process Creation Indicators for LiteLLM Backdoored Package Activity (v1.82.7/v1.82.8)

Windows WinRAR Compression of .dmp/.dump Files via Command Line

Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winrar-compression-of-dmp-dump-files-via-command-line-1ac14d38

title: Windows WinRAR Compression of .dmp/.dump Files via Command Line
id: 15093014-53c1-4214-a719-9841671e2577
related:
  - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7
    type: similar
  - id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
    type: derived
status: test
description: This rule identifies Windows process executions of WinRAR (rar.exe or winrar.exe) where the command line includes dump-related extensions such as .dmp, .dump, or .hdmp. Attackers may compress memory or credential dump outputs to reduce size and facilitate collection or exfiltration. Detection relies on Windows process creation telemetry including the executable path and the full command line content.
references:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-04
modified: 2023-09-12
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \rar.exe
        - \winrar.exe
    - Description: Command line RAR
  selection_extension:
    CommandLine|contains:
      - .dmp
      - .dump
      - .hdmp
  condition: all of selection_*
falsepositives:
  - Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally
  - Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL