
title: Cred Dump Tools Dropped Files
author: Teymur Kheirkhabarov, oscd.community
date: 2019/11/01
description: Files with well-known filenames (parts of credential dump software or
  files produced by them) creation
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    TargetFilename:
    - '*\pwdump*'
    - '*\kirbi*'
    - '*\pwhashes*'
    - '*\wce_ccache*'
    - '*\wce_krbtkts*'
    - '*\fgdump-log*'
  SELECTION_3:
    TargetFilename:
    - '*\test.pwd'
    - '*\lsremora64.dll'
    - '*\lsremora.dll'
    - '*\fgexec.exe'
    - '*\wceaux.dll'
    - '*\SAM.out'
    - '*\SECURITY.out'
    - '*\SYSTEM.out'
    - '*\NTDS.out'
    - '*\DumpExt.dll'
    - '*\DumpSvc.exe'
    - '*\cachedump64.exe'
    - '*\cachedump.exe'
    - '*\pstgdump.exe'
    - '*\servpw.exe'
    - '*\servpw64.exe'
    - '*\pwdump.exe'
    - '*\procdump64.exe'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Legitimate Administrator using tool for password recovery
id: 8fbf3271-1ef6-4e94-8210-03c2317947f6
level: high
logsource:
  category: file_event
  product: windows
modified: 2020/08/23
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
status: experimental
tags:
- attack.credential_access
- attack.t1003
- attack.t1003.001
- attack.t1003.002
- attack.t1003.003
- attack.t1003.004
- attack.t1003.005
ruletype: SIGMA
