sigmahighHunting

Cred Dump Tools Dropped Files

Files with well-known filenames (parts of credential dump software or files produced by them) creation

MITRE ATT&CK

T1003.001 T1003.002 T1003.003 T1003.004 T1003.005

credential-access

Detection Query

selection:
  - TargetFilename|contains:
      - \fgdump-log
      - \kirbi
      - \pwdump
      - \pwhashes
      - \wce_ccache
      - \wce_krbtkts
  - TargetFilename|endswith:
      - \cachedump.exe
      - \cachedump64.exe
      - \DumpExt.dll
      - \DumpSvc.exe
      - \Dumpy.exe
      - \fgexec.exe
      - \lsremora.dll
      - \lsremora64.dll
      - \NTDS.out
      - \procdump.exe
      - \procdump64.exe
      - \procdump64a.exe
      - \pstgdump.exe
      - \pwdump.exe
      - \SAM.out
      - \SECURITY.out
      - \servpw.exe
      - \servpw64.exe
      - \SYSTEM.out
      - \test.pwd
      - \wceaux.dll
condition: selection

Author

Teymur Kheirkhabarov, oscd.community

Created

2019-11-01

Data Sources

windowsFile Events

Platforms

windows

References

https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

Tags

attack.credential-accessattack.t1003.001attack.t1003.002attack.t1003.003attack.t1003.004attack.t1003.005

Raw Content

title: Cred Dump Tools Dropped Files
id: 8fbf3271-1ef6-4e94-8210-03c2317947f6
status: test
description: Files with well-known filenames (parts of credential dump software or files produced by them) creation
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
author: Teymur Kheirkhabarov, oscd.community
date: 2019-11-01
modified: 2025-10-25
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.t1003.002
    - attack.t1003.003
    - attack.t1003.004
    - attack.t1003.005
logsource:
    category: file_event
    product: windows
detection:
    selection:
        - TargetFilename|contains:
              - '\fgdump-log'
              - '\kirbi'
              - '\pwdump'
              - '\pwhashes'
              - '\wce_ccache'
              - '\wce_krbtkts'
        - TargetFilename|endswith:
              - '\cachedump.exe'
              - '\cachedump64.exe'
              - '\DumpExt.dll'
              - '\DumpSvc.exe'
              - '\Dumpy.exe'
              - '\fgexec.exe'
              - '\lsremora.dll'
              - '\lsremora64.dll'
              - '\NTDS.out'
              - '\procdump.exe'
              - '\procdump64.exe'
              - '\procdump64a.exe'
              - '\pstgdump.exe'
              - '\pwdump.exe'
              - '\SAM.out'
              - '\SECURITY.out'
              - '\servpw.exe'
              - '\servpw64.exe'
              - '\SYSTEM.out'
              - '\test.pwd'
              - '\wceaux.dll'
    condition: selection
falsepositives:
    - Legitimate Administrator using tool for password recovery
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files/info.yml