Credential Dumping Tools Service Execution - System
This rule detects the execution of well-known credential dumping tools by monitoring Windows System event logs for Service Control Manager events (EventID 7045) indicating service creation. The rule specifically looks for service image paths containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This helps identify attempts to install and run these tools as services for credential theft.
Sigma
