Detection rules › Sigma
Renamed Procdump tool used for dumping LSASS process
Detects scenarios where an attacker attempts to dump the LSASS process content using a renamed version of the Procdump tool.
Known false positives
- None
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Renamed Procdump tool used for dumping LSASS process
description: Detects scenarios where an attacker attempts to dump the LSASS process content using a renamed version of the Procdump tool.
references:
- https://www.intrinsec.com/apt27-analysis/
- https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
tags:
- attack.execution
- attack.t1569.002
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection_name:
- Image|endswith: '\procdump.exe'
- OriginalFilename: 'procdump.exe'
selection_paramters:
CommandLine|contains|all:
- accepteula
- '-ma' # Write a 'Full' dump file.
condition: selection_name or selection_paramters
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selection_name or selection_paramtersStage 1: selection_name
selection_name:
- Image|endswith: '\procdump.exe'
- OriginalFilename: 'procdump.exe'
Stage 2: selection_paramters
selection_paramters:
CommandLine|contains|all:
- accepteula
- '-ma'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\procdump.exe" |
OriginalFilename | eq |
| field:"OriginalFileName" kind:eq value:"procdump.exe" |