Antivirus - Password Dumper Signature

Status: stable
Severity: critical
Log source: category antivirus
Author: Florian Roth (Nextron Systems), Arnim Rupp
Source: github.com/SigmaHQ/sigma

Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory `T1003.002` OS Credential Dumping: Security Account Manager `T1558` Steal or Forge Kerberos Tickets

Rule body

title: Antivirus - Password Dumper Signature
id: 78cc2dd2-7d20-4d32-93ff-057084c38b93
status: stable
description: |
    Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
    - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
author: Florian Roth (Nextron Systems), Arnim Rupp
date: 2018-09-09
modified: 2026-06-15
tags:
    - attack.credential-access
    - attack.t1003
    - attack.t1558
    - attack.t1003.001
    - attack.t1003.002
logsource:
    category: antivirus
detection:
    selection:
        - Signature|startswith: 'PWS'
        - Signature|contains:
              - 'Certify'
              - 'DCSync'
              - 'Creddump'
              - 'DumpCreds'
              - 'DumpLsass'
              - 'DumpPert'
              - 'FormBook'
              - 'HTool/WCE'
              - 'Kekeo'
              - 'Lazagne'
              - 'LsassDump'
              - 'Lummast'
              - 'Mimikatz'
              - 'MultiDump'
              - 'Multiverze'
              - 'Nanodump'
              - 'NativeDump'
              - 'Outflank'
              - 'PShlSpy'
              - 'PSWTool'
              - 'PWCrack'
              - 'PWDump'
              - 'PWS.'
              - 'PWSX'
              - 'pypykatz'
              - 'Rubeus'
              - 'SafetyKatz'
              - 'SecurityTool'
              - 'SharpChrome'
              - 'SharpDPAPI'
              - 'SharpDump'
              - 'SharpKatz'
              - 'SharpS.' # Sharpsploit, e.g. 530ea2ff9049f5dfdfa0a2e9c27c2e3c0685eb6cbdf85370c20a7bfae49f592d
              - 'ShpKatz'
              - 'Steal'
              - 'TrickDump'
              - 'wsass'
    condition: selection
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Signature|startswith: 'PWS'
    - Signature|contains:
          - 'Certify'
          - 'DCSync'
          - 'Creddump'
          - 'DumpCreds'
          - 'DumpLsass'
          - 'DumpPert'
          - 'FormBook'
          - 'HTool/WCE'
          - 'Kekeo'
          - 'Lazagne'
          - 'LsassDump'
          - 'Lummast'
          - 'Mimikatz'
          - 'MultiDump'
          - 'Multiverze'
          - 'Nanodump'
          - 'NativeDump'
          - 'Outflank'
          - 'PShlSpy'
          - 'PSWTool'
          - 'PWCrack'
          - 'PWDump'
          - 'PWS.'
          - 'PWSX'
          - 'pypykatz'
          - 'Rubeus'
          - 'SafetyKatz'
          - 'SecurityTool'
          - 'SharpChrome'
          - 'SharpDPAPI'
          - 'SharpDump'
          - 'SharpKatz'
          - 'SharpS.'
          - 'ShpKatz'
          - 'Steal'
          - 'TrickDump'
          - 'wsass'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Signature`	match	`Certify` `Creddump` `DCSync` `DumpCreds` `DumpLsass` `DumpPert` `FormBook` `HTool/WCE` `Kekeo` `Lazagne` `LsassDump` `Lummast` `Mimikatz` `MultiDump` `Multiverze` `Nanodump` `NativeDump` `Outflank` `PSWTool` `PShlSpy` `PWCrack` `PWDump` `PWS.` `PWSX` `Rubeus` `SafetyKatz` `SecurityTool` `SharpChrome` `SharpDPAPI` `SharpDump` `SharpKatz` `SharpS.` `ShpKatz` `Steal` `TrickDump` `pypykatz` `wsass`	`field:"Signature" kind:match`
`Signature`	starts_with	`PWS`	`field:"Signature" kind:starts_with value:"PWS"`