Potential SysInternals ProcDump Evasion
Attack scenariowindows:auditMITRE T1036MITRE T1003.001
- By
- sigmahq
- Version
- 0.2
- Name
- sigmahq/proc_creation_win_sysinternals_procdump_evasion
- Remediation
- Alert only
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name
Install with a top-level collection
1 collection include itsudo cscli collections install sigmahq/windows_proc_creationInstalls 1 parser and 520 scenarios.
View Windows - Suspicious Process Detection →Installation
sudo cscli scenarios install sigmahq/proc_creation_win_sysinternals_procdump_evasionThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: triggername: sigmahq/proc_creation_win_sysinternals_procdump_evasiondescription: |Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different namefilter: |(evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'copy procdump' || evt.Parsed.CommandLine contains 'move procdump' || evt.Parsed.CommandLine contains 'copy ' && evt.Parsed.CommandLine contains '.dmp ' && (evt.Parsed.CommandLine contains '2.dmp' || evt.Parsed.CommandLine contains 'lsass' || evt.Parsed.CommandLine contains 'out.dmp') || evt.Parsed.CommandLine contains 'copy lsass.exe_' || evt.Parsed.CommandLine contains 'move lsass.exe_')blackhole: 2m#status: testlabels:service: windowsconfidence: 1spoofable: 0classification:- attack.t1036- attack.t1003.001label: "Potential SysInternals ProcDump Evasion"behavior : "windows:audit"remediation: falsescope:type: ParentProcessIdexpression: evt.Parsed.ParentProcessId
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.