From 7c2f3231d3b4f535fdd08c8d2b722745d4fed88e Mon Sep 17 00:00:00 2001
From: mrd0x <ahmad-alsabagh@hotmail.com>
Date: Sun, 15 May 2022 16:21:45 -0400
Subject: [PATCH] Adding Dump64.exe (#182)

Co-authored-by: mrd0x <mrd0x@example.com>
Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OtherMSBinaries/Dump64.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 yml/OtherMSBinaries/Dump64.yml

diff --git a/yml/OtherMSBinaries/Dump64.yml b/yml/OtherMSBinaries/Dump64.yml
new file mode 100644
index 0000000..4adb7c9
--- /dev/null
+++ b/yml/OtherMSBinaries/Dump64.yml
@@ -0,0 +1,24 @@
+---
+Name: Dump64.exe
+Description: Memory dump tool that comes with Microsoft Visual Studio
+Author: mr.d0x
+Created: 2021-11-16
+Commands:
+  - Command: dump64.exe <pid> out.dmp
+    Description: Creates a memory dump of the LSASS process.
+    Usecase: Create memory dump and parse it offline to retrieve credentials.
+    Category: Dump
+    Privileges: Administrator
+    MitreID: T1003.001
+    OperatingSystem: Windows 10, Windows 11
+Full_Path:
+  - Path: C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\dump64.exe
+Detection:
+  - Sigma: https://github.com/SigmaHQ/sigma/blob/138b06628380468fb8a41fc27770e1630cb64326/rules/windows/process_creation/process_creation_win_lolbas_dump64.yml
+  - IOC: As a Windows SDK binary, execution on a system may be suspicious
+Resources:
+  - Link: https://twitter.com/mrd0x/status/1460597833917251595
+Acknowledgement:
+  - Person: mr.d0x
+    Handle: '@mrd0x'
+---