Title:
Winrar Compressing Dump Files
Status:
test
Description:Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
References:
-https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
Author: Florian Roth (Nextron Systems)
Date: 2022-01-04
modified:2023-09-12
Tags:
- -'attack.collection'
- -'attack.t1560.001'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_img:
- Image|endswith:
- '\rar.exe'
- '\winrar.exe'
Description:
'Command line RAR'
selection_extension:
CommandLine|contains:
-'.dmp'
-'.dump'
-'.hdmp'
condition:
all of selection_*
Falsepositives:
-Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally
-Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting
Level:
medium
