title: Winrar Compressing Dump Files
id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc
status: experimental
description: Detects a suspicious winrar execution that involves a file with a .dmp extension, which could be a step in a process of dump file exfiltration
references:
    - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
author: Florian Roth
date: 2022/01/04
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: 
            - '\rar.exe'
            - '\winrar.exe'
        - Description: 'Command line RAR'
    dumpfile:
        CommandLine: '.dmp'
    condition: selection and dumpfile
falsepositives:
    - Legitimate use of WinRAR with a command line in which .dmp appears incidentally
level: high
tags:
    - attack.collection
    - attack.t1560.001