These rules cover memory allocation, mapping, access, modification, related process activity, and dump file artifacts. A matching file name does not establish the file's contents.
Memory Allocation and Protection #
Rules select memory allocations and protection changes in the calling process or another process.
No rules currently have sufficient source evidence for selection in this section.
Memory Section Mapping #
Rules select memory mappings by their permissions, source file, or target process.
No rules currently have sufficient source evidence for selection in this section.
Cross Process Memory Writes #
Rules select writes and protection changes in other processes.
No rules currently have sufficient source evidence for selection in this section.
Process Memory Access and Dumping #
Rules select LSASS access and memory dump attempts.
No rules currently have sufficient source evidence for selection in this section.
Image and Module Memory Evidence #
Rules select changes to executable memory and library loads.
No rules currently have sufficient source evidence for selection in this section.
Memory and Call Stack Context #
Rules select process starts, network calls, and library loads using memory properties or call stacks.
No rules currently have sufficient source evidence for selection in this section.
Memory Dump File Artifacts #
Rules select file activity and names associated with memory dumps. The selected paths and names do not establish file contents or credential extraction.
- HackTool - Dumpert Process Dumper Default File Sigma
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Memory Patching and API Hooking #
Rules select changes to executable memory or calls that can alter code and API behavior.
No rules currently have sufficient source evidence for selection in this section.
Unusual Memory API Caller and Stack Context #
Rules select memory API calls with unusual caller modules, stack frames, or memory properties.
No rules currently have sufficient source evidence for selection in this section.
Memory API and Process or Module Context #
Rules combine memory API activity with process, module, or related event context. Some select a single event, while others correlate several events.
No rules currently have sufficient source evidence for selection in this section.
Mixed Memory API Context #
Rules select memory API alternatives with caller, stack, or kernel address context. Individual matches may involve local protection changes or remote operations.
No rules currently have sufficient source evidence for selection in this section.
References #
- [1] Microsoft Learn: About Memory Management
- [2] Microsoft Learn: MEMORY_BASIC_INFORMATION structure
- [3] Microsoft Learn: VirtualAlloc function
- [4] Microsoft Learn: VirtualAllocEx function
- [5] Microsoft Learn: VirtualProtect function
- [6] Microsoft Learn: MapViewOfFile function
- [7] Microsoft Learn: MapViewOfFile2 function
- [8] Microsoft Learn: WriteProcessMemory function
- [9] Microsoft Learn: ReadProcessMemory function
- [10] Elastic Docs: Elastic Defend advanced settings
- [11] Elastic Docs: Elastic Defend integration fields
- [12] Elastic Security Labs: Detecting in-memory threats with kernel ETW call stacks