Process Memory Dump Via Dotnet-Dump

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.

Known false positives

Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Process Memory Dump Via Dotnet-Dump
id: 53d8d3e1-ca33-4012-adf3-e05a4d652e34
status: test
description: |
    Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.
references:
    - https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect
    - https://twitter.com/bohops/status/1635288066909966338
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-14
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\dotnet-dump.exe'
        - OriginalFileName: 'dotnet-dump.dll'
    selection_cli:
        CommandLine|contains: 'collect'
    condition: all of selection_*
falsepositives:
    - Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\dotnet-dump.exe'
    - OriginalFileName: 'dotnet-dump.dll'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: 'collect'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`collect` corpus 2 (sigma 2)	`field:"CommandLine" kind:match value:"collect"`
`Image`	ends_with	`\dotnet-dump.exe`	`field:"Image" kind:ends_with value:"\dotnet-dump.exe"`
`OriginalFileName`	eq	`dotnet-dump.dll`	`field:"OriginalFileName" kind:eq value:"dotnet-dump.dll"`