The doppelpaymer-procdump rule detects potential ransomware activity where an adversary is using procdump to extract memory dumps from running processes, which could indicate post-exploitation behavior to exfiltrate data or prepare for encryption. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early signs of DoppelPaymer ransomware execution and mitigate data loss before encryption occurs.
KQL Query
// Dumping of LSASS memory using procdump
DeviceProcessEvents
| where Timestamp > ago(7d)
// Command lines that include "lsass" and -accepteula or -ma flags used in procdump
| where (ProcessCommandLine has "lsass" and (ProcessCommandLine has "-accepteula" or
ProcessCommandLine contains "-ma"))
// Omits possible FPs where the full command is just "procdump.exe lsass"
or (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')
id: ce3cc53c-14a7-4ee5-95c6-b26cbc01d20b
name: doppelpaymer-procdump
description: |
This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.
DoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. For example, they use SysInternal utilities such as ProcDump to dump credentials from LSASS. They often use these stolen credentials to turn off security software, run malicious commands, and spread malware throughout an organization.
The following query detects ProcDump being used to dump credentials from LSASS.
The See also section below lists links to other queries associated with DoppelPaymer.
References:
https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372
https://docs.microsoft.com/sysinternals/downloads/procdump
https://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceProcessEvents
tactics:
- Credential Access
query: |
// Dumping of LSASS memory using procdump
DeviceProcessEvents
| where Timestamp > ago(7d)
// Command lines that include "lsass" and -accepteula or -ma flags used in procdump
| where (ProcessCommandLine has "lsass" and (ProcessCommandLine has "-accepteula" or
ProcessCommandLine contains "-ma"))
// Omits possible FPs where the full command is just "procdump.exe lsass"
or (FileName in~ ('procdump.exe','procdump64.exe') and ProcessCommandLine has 'lsass')
| Sentinel Table | Notes |
|---|---|
DeviceProcessEvents | Ensure this data connector is enabled |
Scenario: System Backup Process Using Procdump
Description: A legitimate system backup process uses procdump to create memory dumps of running services for troubleshooting or analysis.
Filter/Exclusion: Exclude processes associated with backup tools like Veeam, Commvault, or Veritas, or filter by process.name containing “backup” or “dump”.
Scenario: Scheduled Job for Memory Analysis
Description: A scheduled job runs procdump to analyze memory usage of a service (e.g., sqlservr.exe) for performance monitoring.
Filter/Exclusion: Exclude processes with process.name matching known services like sqlservr.exe, svchost.exe, or w3wp.exe, or filter by event_id or job_name indicating scheduled tasks.
Scenario: Admin Task to Analyze Crashed Service
Description: An administrator uses procdump to capture a memory dump of a service that crashed, to aid in post-mortem analysis.
Filter/Exclusion: Exclude processes where the parent process is a known admin tool like taskmgr.exe, explorer.exe, or powershell.exe, or filter by user field to exclude non-admin users.
Scenario: Debugging with Visual Studio or WinDbg
Description: A developer or support engineer uses procdump in conjunction with debugging tools like Visual Studio or WinDbg to analyze a service’s memory state.
Filter/Exclusion: Exclude processes where the parent process is devenv.exe, vsdebugger.exe, or windbg.exe, or filter by process.name containing “debug” or “vs”.
Scenario: Automated Monitoring Tool Generating Dumps
Description: A monitoring tool like `