Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Winrar Compressing Dump Files

Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Tue Jan 04Updated Tue Sep 121ac14d38-3dfc-4635-92c7-e3fd1c5f5bfcwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith:
              - '\rar.exe'
              - '\winrar.exe'
        - Description: 'Command line RAR'
    selection_extension:
        CommandLine|contains:
            - '.dmp'
            - '.dump'
            - '.hdmp'
    condition: all of selection_*
False Positives

Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally

Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting

References
1
Resolving title…
crowdstrike.com
MITRE ATT&CK
Related Rules
SimilarDetectionmedium

7Zip Compressing Dump Files

Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata
Rule ID
1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
Status
test
Level
medium
Type
Detection
Created
Tue Jan 04
Modified
Tue Sep 12
Author
Florian Roth (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml
Raw Tags
attack.collectionattack.t1560.001
View on GitHub