Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the use of the built-in Windows 'copy' command via 'cmd.exe' to transfer files with '.dmp', '.dump', or '.hdmp' extensions from a remote network share (indicated by '\\') to a local system. This activity is often associated with credential dumping techniques where memory dumps (e.g., LSASS process memory dumps) containing sensitive information are exfiltrated or staged.