Detection rules › Sigma

HackTool - Quarks PwDump Execution

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects usage of the Quarks PwDump tool via commandline arguments

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.002 OS Credential Dumping: Security Account Manager

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: 1 of selection_img

Image|endswith: '\QuarksPwDump.exe'

Stage 2: 1 of selection_cli

CommandLine: [' --dump-bitlocker', ' --dump-hash-domain ', ' --dump-hash-domain-cached', ' --dump-hash-local', ' -dhd ', ' -dhdc', ' -dhl', --ntds-file]

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineeq
  • --dump-bitlocker
  • --dump-hash-domain
  • --dump-hash-domain-cached
  • --dump-hash-local
  • -dhd
  • -dhdc
  • -dhl
  • --ntds-file
Imageends_with
  • \QuarksPwDump.exe corpus 2 (sigma 2)