Cred Dump Tools Dropped Files

Title: Cred Dump Tools Dropped Files
Status: test
Description:Files with well-known filenames (parts of credential dump software or files produced by them) creation
References:
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-11-01
modified:2025-10-25
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'
• -'attack.t1003.002'
• -'attack.t1003.003'
• -'attack.t1003.004'
• -'attack.t1003.005'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    - TargetFilename|contains:
      - '\fgdump-log'
      - '\kirbi'
      - '\pwdump'
      - '\pwhashes'
      - '\wce_ccache'
      - '\wce_krbtkts'
    - TargetFilename|endswith:
      - '\cachedump.exe'
      - '\cachedump64.exe'
      - '\DumpExt.dll'
      - '\DumpSvc.exe'
      - '\Dumpy.exe'
      - '\fgexec.exe'
      - '\lsremora.dll'
      - '\lsremora64.dll'
      - '\NTDS.out'
      - '\procdump.exe'
      - '\procdump64.exe'
      - '\procdump64a.exe'
      - '\pstgdump.exe'
      - '\pwdump.exe'
      - '\SAM.out'
      - '\SECURITY.out'
      - '\servpw.exe'
      - '\servpw64.exe'
      - '\SYSTEM.out'
      - '\test.pwd'
      - '\wceaux.dll'
  condition:selection
Falsepositives:
  -Legitimate Administrator using tool for password recovery
Level: high