Sigma rule: Cred Dump Tools Dropped Files

Rule

Title

Cred Dump Tools Dropped Files

Status

test

Level

high

Author

Teymur Kheirkhabarov, oscd.community

Date

2019-11-01

Modified

2025-10-25

File

rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Files with well-known filenames (parts of credential dump software or files produced by them) creation

Log source

product

windows

category

file_event

Detection

selection:
    - TargetFilename|contains:
          - '\fgdump-log'
          - '\kirbi'
          - '\pwdump'
          - '\pwhashes'
          - '\wce_ccache'
          - '\wce_krbtkts'
    - TargetFilename|endswith:
          - '\cachedump.exe'
          - '\cachedump64.exe'
          - '\DumpExt.dll'
          - '\DumpSvc.exe'
          - '\Dumpy.exe'
          - '\fgexec.exe'
          - '\lsremora.dll'
          - '\lsremora64.dll'
          - '\NTDS.out'
          - '\procdump.exe'
          - '\procdump64.exe'
          - '\procdump64a.exe'
          - '\pstgdump.exe'
          - '\pwdump.exe'
          - '\SAM.out'
          - '\SECURITY.out'
          - '\servpw.exe'
          - '\servpw64.exe'
          - '\SYSTEM.out'
          - '\test.pwd'
          - '\wceaux.dll'
condition: selection

False positives (as the rule lists them)

• Legitimate Administrator using tool for password recovery

Tags

• attack.credential-access
• attack.t1003.001
• attack.t1003.002
• attack.t1003.003
• attack.t1003.004
• attack.t1003.005

MITRE ATT&CK ids this rule names

• T1003.001
• T1003.002
• T1003.003
• T1003.004
• T1003.005

References

• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml