Potential Windows Defender AV Bypass via Dump64.EXE Rename

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects attempts to bypass Windows Defender by renaming a legitimate tool, specifically `procdump`, to `dump64.exe` and placing it within a Microsoft Visual Studio installation directory. This technique is often used to dump LSASS memory for credential access.