Detection rules › Sigma

HackTool - CreateMiniDump Execution

Severity
high
Author
Florian Roth (Nextron Systems)
Source
upstream

Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection

or:
Hashes|contains: 'IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f'
Image|endswith: '\CreateMiniDump.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Hashesmatch
  • IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f
Imageends_with
  • \CreateMiniDump.exe corpus 2 (sigma 2)