Detectionhighexperimental

PUA - Memory Dump Mount Via MemProcFS

Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Apr 278a1b2c3d-4e5f-6789-abcd-ef1234567890windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\MemProcFS.exe'
        - OriginalFileName: 'MemProcFS.exe'
        - Description: 'MemProcFS'
    selection_cli:
        CommandLine|contains: '-device'
    condition: all of selection_*
False Positives

Legitimate use during memory forensics; if not part of authorized analysis, warrants urgent investigation

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)
Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

Rule Metadata
Rule ID
8a1b2c3d-4e5f-6789-abcd-ef1234567890
Status
experimental
Level
high
Type
Detection
Created
Mon Apr 27
Path
rules/windows/process_creation/proc_creation_win_pua_memprocfs.yml
Raw Tags
attack.credential-accessattack.t1003attack.t1003.001attack.t1003.004attack.t1003.002
View on GitHub