Credential Dumping Tools Service Execution
This rule detects the execution of well-known credential dumping tools by monitoring Windows Security Event ID 4697, which signifies a service creation event. The rule specifically looks for service filenames containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This indicates an adversary attempting to install and run a service that can extract credentials from the system.
Sigma
