Detection rules › Sigma

Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

MITRE ATT&CK coverage

TacticTechniques
Credential AccessNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
id: 044ba588-dff4-4918-9808-3f95e8160606
status: test
description: Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share
references:
    - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-27
modified: 2023-09-12
tags:
    - attack.credential-access
logsource:
    category: process_creation
    product: windows
detection:
    # Example: copy \\<host>\\<folder>\\process.dmp C:\Users\process.dmp
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cli:
        CommandLine|contains|all:
            - 'copy '
            - ' \\\\'
        CommandLine|contains:
            - '.dmp'
            - '.dump'
            - '.hdmp'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|all:
        - 'copy '
        - ' \\\\'
    CommandLine|contains:
        - '.dmp'
        - '.dump'
        - '.hdmp'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • \\\\ corpus 8 (sigma 8)
  • .dmp corpus 10 (sigma 8, chronicle 2)
  • .dump corpus 3 (sigma 3)
  • .hdmp corpus 3 (sigma 3)
  • copy corpus 12 (sigma 11, chronicle 1)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
OriginalFileNameeq
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)