DumpStack.log Defender Evasion

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the use of the filename 'DumpStack.log' for a process image or in a command line when downloading, which is a known technique to evade Microsoft Defender. Adversaries may rename malicious executables to 'DumpStack.log' to bypass security controls that might ignore or whitelist files with this name, or use it as an output file name for downloads.