Credential Dumping Tool File Creation
This rule detects the creation of files with names commonly associated with credential dumping tools or files produced by them. It looks for specific filenames or patterns in the full path of newly created files, such as logs from fgdump, kirbi files, pwdump outputs, cachedump executables, procdump outputs, and Windows Credential Editor (WCE) related files. This indicates an attempt to extract credentials from the system.
YARA-L
