SEKOIA.IO Rules medium stable sigma

Usage Of Procdump With Common Arguments

Detects the usage of Procdump sysinternals tool with some common arguments and followed by common patterns.

View Source

Detection Logic

selection:
  process.command_line
| re: (?i)(accepteula)?(.*\s(-
| /)(mm
| ma
| mt
| mk
| mc
| mp
| md)\s.*(\.exe
| lsass
| \.dll
| \.dmp
| AppData
| ProgramData).*)
filter:
  process.command_line
| contains:
    - java
    - bigobj
    - cl.exe
    - cc1.exe
    - SOLIDWORKS
condition: selection and not filter

Field Validations

Loading…

Comments (0)

Loading comments...