Potential Windows Defender AV Bypass Via Dump64.EXE Rename
Attack scenariowindows:auditMITRE T1003.001
- By
- sigmahq
- Version
- 0.2
- Name
- sigmahq/proc_creation_win_dump64_defender_av_bypass_rename
- Remediation
- Alert only
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
Install with a top-level collection
1 collection include itsudo cscli collections install sigmahq/windows_proc_creationInstalls 1 parser and 520 scenarios.
View Windows - Suspicious Process Detection →Installation
sudo cscli scenarios install sigmahq/proc_creation_win_dump64_defender_av_bypass_renameThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: triggername: sigmahq/proc_creation_win_dump64_defender_av_bypass_renamedescription: |Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder. Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.filter: |(evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image startsWith ':\\Program Files' && evt.Parsed.Image contains '\\Microsoft Visual Studio\\' && evt.Parsed.Image endsWith '\\dump64.exe' && (evt.Parsed.OriginalFileName == 'procdump' || evt.Parsed.CommandLine contains ' -ma ' || evt.Parsed.CommandLine contains ' -mp '))blackhole: 2m#status: testlabels:service: windowsconfidence: 1spoofable: 0classification:- attack.t1003.001label: "Potential Windows Defender AV Bypass Via Dump64.EXE Rename"behavior : "windows:audit"remediation: falsescope:type: ParentProcessIdexpression: evt.Parsed.ParentProcessId
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.