Process Memory Dump Via Dotnet-Dump

Title: Process Memory Dump Via Dotnet-Dump
Status: test
Description:Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.
References:
  -https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect
  -https://twitter.com/bohops/status/1635288066909966338
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\dotnet-dump.exe' OriginalFileName:'dotnet-dump.dll'   selection_cli:
    CommandLine|contains: 'collect'
  condition:all of selection_*
Falsepositives:
  -Process dumping is the expected behavior of the tool. So false positives are expected in legitimate usage. The PID/Process Name of the process being dumped needs to be investigated
Level: medium