HackTool - CreateMiniDump Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•15

Detects the execution of the `CreateMiniDump.exe` utility or a process with a specific import hash associated with `CreateMiniDump`, which is used to dump the LSASS process memory for credential extraction. This tool is often used by attackers to bypass antivirus signatures that might detect `mimikatz` or similar tools.