{"id":"129966c9-de17-4334-a123-8b58172e664d","title":"Potential Windows Defender AV Bypass Via Dump64.EXE Rename","description":"Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.\nCurrently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.\n","author":"Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-11-26","modified":"2024-06-21","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://twitter.com/mrd0x/status/1460597833917251595"],"source_path":"rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml","source_sha256":"a42b5ffc23a8db731da5e77cf226c7983cb4b992aa460c700d78dbd059dbf450","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename\nid: 129966c9-de17-4334-a123-8b58172e664d\nstatus: test\ndescription: |\n    Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.\n    Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.\nreferences:\n    - https://twitter.com/mrd0x/status/1460597833917251595\nauthor: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-11-26\nmodified: 2024-06-21\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_dump:\n        Image|startswith: ':\\Program Files'\n        Image|contains: '\\Microsoft Visual Studio\\'\n        Image|endswith: '\\dump64.exe'\n    selection_tools_procdump:\n        - OriginalFileName: 'procdump'\n        - CommandLine|contains:\n              - ' -ma ' # Full Dump\n              - ' -mp ' # Mini Plus\n    condition: selection_dump and 1 of selection_tools_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/129966c9-de17-4334-a123-8b58172e664d.json","kind":"sigma"}