HackTool - Dumpert Process Dumper Default File

Title: HackTool - Dumpert Process Dumper Default File
Status: test
Description:Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
References:
  -https://github.com/outflanknl/Dumpert
  -https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/
Author: Florian Roth (Nextron Systems)
Date: 2020-02-04
modified:2023-05-09
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|endswith: 'dumpert.dmp'
  condition:selection
Falsepositives:
  -Very unlikely
Level: critical