CreateDump Process Memory Dump

SigmaHQ Detections@sigmaHQ

•updated Apr 25, 2025•0•15

Detects the use of 'createdump.exe', a legitimate Windows utility, to dump process memory. This technique is often used by adversaries to extract credentials from processes like LSASS. The rule specifically looks for the execution of 'createdump.exe' or its original filename 'FX_VER_INTERNALNAME_STR' combined with command-line arguments indicative of a memory dump operation, such as '-u', '--full', '-f', '--name', or '.dmp'.