Potential Windows Defender AV Bypass Via Dump64.EXE Rename

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename
id: 129966c9-de17-4334-a123-8b58172e664d
status: test
description: |
    Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
    Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
references:
    - https://twitter.com/mrd0x/status/1460597833917251595
author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-11-26
modified: 2024-06-21
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_dump:
        Image|startswith: ':\Program Files'
        Image|contains: '\Microsoft Visual Studio\'
        Image|endswith: '\dump64.exe'
    selection_tools_procdump:
        - OriginalFileName: 'procdump'
        - CommandLine|contains:
              - ' -ma ' # Full Dump
              - ' -mp ' # Mini Plus
    condition: selection_dump and 1 of selection_tools_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_dump and 1 of selection_tools_*

Stage 1: `selection_dump`

selection_dump:
    Image|startswith: ':\Program Files'
    Image|contains: '\Microsoft Visual Studio\'
    Image|endswith: '\dump64.exe'

Stage 2: `selection_tools_procdump`

selection_tools_procdump:
    - OriginalFileName: 'procdump'
    - CommandLine|contains:
          - ' -ma '
          - ' -mp '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-ma` corpus 5 (sigma 4, chronicle 1) `-mp` corpus 3 (sigma 3)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\dump64.exe`	`field:"Image" kind:ends_with value:"\dump64.exe"`
`Image`	match	`\Microsoft Visual Studio\`	`field:"Image" kind:match value:"\Microsoft Visual Studio\"`
`Image`	starts_with	`:\Program Files`	`field:"Image" kind:starts_with value:":\Program Files"`
`OriginalFileName`	eq	`procdump` corpus 6 (elastic 3, sigma 2, splunk 1)	`field:"OriginalFileName" kind:eq value:"procdump"`