Sigma rule: PUA - Memory Dump Mount Via MemProcFS

Rule

Title

PUA - Memory Dump Mount Via MemProcFS

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-04-27

File

rules/windows/process_creation/proc_creation_win_pua_memprocfs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\MemProcFS.exe'
    - OriginalFileName: 'MemProcFS.exe'
    - Description: 'MemProcFS'
selection_cli:
    CommandLine|contains: '-device'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate use during memory forensics; if not part of authorized analysis, warrants urgent investigation

Tags

• attack.credential-access
• attack.t1003
• attack.t1003.001
• attack.t1003.004
• attack.t1003.002

MITRE ATT&CK ids this rule names

• T1003
• T1003.001
• T1003.002
• T1003.004

References

• https://github.com/ufrisk/MemProcFS
• https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html#
• https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_pua_memprocfs.yml