Date: 11/26/2024
Severity: High
Summary
Detects the use of the CreateMiniDump tool, commonly used to dump the LSASS process memory for credential extraction on an attacker’s machine.
Indicators of Compromise (IOC) List
Image : | '\CreateMiniDump.exe' |
Hashes : |
'IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f'
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1: | (resourcename = "Windows Security" AND eventtype = "4688" ) AND (processname like "CreateMiniDump.exe" OR newprocessname like "CreateMiniDump.exe" ) |
Detection Query 2: | (technologygroup = "EDR" ) AND (processname like "CreateMiniDump.exe" OR newprocessname like "CreateMiniDump.exe" ) |
Detection Query 3: |
md5hash IN ("4a07f944a83e8a7c2525efa35dd30e2f") |
Reference:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_createminidump.yml