Dumping Process via Sqldumper.exe

Title: Dumping Process via Sqldumper.exe
Status: test
Description:Detects process dump via legitimate sqldumper.exe binary
References:
  -https://twitter.com/countuponsec/status/910977826853068800
  -https://twitter.com/countuponsec/status/910969424215232518
  -https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/
Author: Kirill Kiryanov, oscd.community
Date: 2020-10-08
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\sqldumper.exe'
    CommandLine|contains:
      -'0x0110'
      -'0x01100:40'

  condition:selection
Falsepositives:
  -Legitimate MSSQL Server actions
Level: medium