Date: 04/30/2025
Severity: Medium
Summary
Detects the use of the LOLOBIN utility "createdump.exe" for capturing process memory dumps.
Indicators of Compromise (IOC) List
Image : | '\createdump.exe' |
OriginalFileName : | 'FX_VER_INTERNALNAME_STR' |
CommandLine : | - ' -u ' - ' --full ' - ' -f ' - ' --name ' - '.dmp ' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query : | (resourcename = "Windows Security" AND eventtype = "4688" ) AND processname like "createdump.exe" AND commandline IN ("-u", "--full", "-f", "--name", ".dmp" ) |
Detection Query : | technologygroup = "EDR" AND processname like "createdump.exe" AND commandline IN ("-u", "--full", "-f", "--name", ".dmp" ) |
Reference:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml