These rules cover memory allocation, mapping, access, modification, related process activity, and dump file artifacts. A matching file name does not establish the file's contents.
Allocation and Protection #
Rules select memory allocations and protection changes in the calling process or another process.
No rules currently have sufficient source evidence for selection in this section.
Section Mapping #
Rules select memory mappings by their permissions, source file, or target process.
No rules currently have sufficient source evidence for selection in this section.
Cross Process Writes #
Rules select writes and protection changes in other processes.
No rules currently have sufficient source evidence for selection in this section.
Process Memory Access and Dumping #
Rules select LSASS access and memory dump attempts.
No rules currently have sufficient source evidence for selection in this section.
Image and Module Evidence #
Rules select changes to executable memory and library loads.
No rules currently have sufficient source evidence for selection in this section.
Call Stack Context #
Rules select process starts, network calls, and library loads using memory properties or call stacks.
No rules currently have sufficient source evidence for selection in this section.
Dump Files #
Rules select file activity and names associated with memory dumps. The selected paths and names do not establish file contents or credential extraction.
- HackTool - Dumpert Process Dumper Default File Sigma
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Memory Patching and API Hooking #
Rules select changes to executable memory or calls that can alter code and API behavior.
No rules currently have sufficient source evidence for selection in this section.
Unusual API Callers and Stacks #
Rules select memory API calls with unusual caller modules, stack frames, or memory properties.
No rules currently have sufficient source evidence for selection in this section.
API and Process or Module Context #
Rules combine memory API activity with process, module, or related event context. Some select a single event, while others correlate several events.
No rules currently have sufficient source evidence for selection in this section.
Mixed API Context #
Rules select memory API alternatives with caller, stack, or kernel address context. Individual matches may involve local protection changes or remote operations.
No rules currently have sufficient source evidence for selection in this section.
References #
- [1] Microsoft Learn: About Memory Management
- [2] Microsoft Learn: MEMORY_BASIC_INFORMATION structure
- [3] Microsoft Learn: VirtualAlloc function
- [4] Microsoft Learn: VirtualAllocEx function
- [5] Microsoft Learn: VirtualProtect function
- [6] Microsoft Learn: MapViewOfFile function
- [7] Microsoft Learn: MapViewOfFile2 function
- [8] Microsoft Learn: WriteProcessMemory function
- [9] Microsoft Learn: ReadProcessMemory function
- [10] Elastic Docs: Elastic Defend advanced settings
- [11] Elastic Docs: Elastic Defend integration fields
- [12] Elastic Security Labs: Detecting in-memory threats with kernel ETW call stacks