CreateDump Process Dump

Title: CreateDump Process Dump
Status: test
Description:Detects uses of the createdump.exe LOLOBIN utility to dump process memory
References:
  -https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  -https://twitter.com/bopin2020/status/1366400799199272960
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-04
modified:2022-08-19
Tags:

• -'attack.stealth'
• -'attack.t1036'
• -'attack.t1003.001'
• -'attack.credential-access'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\createdump.exe' OriginalFileName:'FX_VER_INTERNALNAME_STR'   selection_cli:
    CommandLine|contains:
      -' -u '
      -' --full '
      -' -f '
      -' --name '
      -'.dmp '

  condition:all of selection_*
Falsepositives:
  -Command lines that use the same flags
Level: high