Anvilogic high experimental spl

MultiDump.exe Execution [splunk-winevent]

MultiDump is a post-exploitation tool written in C with a Python handler designed to discreetly dump and extract LSASS memory without triggering Defender alerts. This use case detects rundll32 executions with specific command line parameters unique to MultiDump.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) 
OR "<EventID>4688<" 
OR Type=Process) "rundll32" "OpenOptimizationControlPanel" "cleanup" "defrag" "optimize:startup" "report" ".dmp"
| table _time, host, user, process, process_*, parent_process_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...