memdump diablo

Hunt Hypothesis

This detection identifies adversaries leveraging memory dumping tools to extract sensitive data or credentials from running processes within Azure Sentinel workloads. Proactively hunting for this behavior is critical because even low-severity memory extraction activities often serve as a precursor to advanced credential theft and lateral movement campaigns that may evade standard signature-based defenses.

YARA Rule

rule memdump_diablo
{
meta:
	author = "@patrickrolsen"
	reference = "Process Memory Dumper - DiabloHorn"
strings:
	$s1 = "DiabloHorn"
	$s2 = "Process Memory Dumper"
	$s3 = "pid-%s.dmp"
	$s4 = "Pid %d in not acessible" // SIC
	$s5 = "memdump.exe"
	$s6 = "%s-%d.dmp"
condition:
	uint16(0) == 0x5A4D and 3 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• Process Memory Dumper - DiabloHorn
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the memdump_diablo detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Detection and Response (EDR) Memory Scanning

  • Scenario: EDR agents like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently perform deep memory scans to detect fileless malware. These tools often spawn dedicated processes that attach to running system services and extract memory dumps of critical components (e.g., svchost.exe or browser engines) as part of their routine “memory integrity” checks, mimicking the behavior of a malicious memory dumper.
  • Filter/Exclusion: Create an exclusion for the specific EDR service executables known to perform these scans (e.g., C:\Program Files\CrowdStrike\fsagent.exe or MsMpEng.exe). Additionally, filter events where the parent process is the EDR service and the target memory dump filename contains standard vendor naming conventions (e.g., ending in .falcon_dump or _defender_mem).

• Automated Performance Diagnostics via Windows Task Scheduler

  • Scenario: IT Operations teams often configure scheduled tasks using Windows Task Scheduler to run diagnostic utilities like procdump.exe (part of Sysinternals) or custom PowerShell scripts. These jobs are triggered during off-peak hours (e.g., 02:00 AM) to capture memory states of high-resource applications (like SQL Server or Exchange) for performance trending, which triggers the YARA rule’s detection logic for active memory dumping.
  • Filter/Exclusion: Exclude events occurring within specific time windows (e.g., 01:00–04:00 local time) where the initiating process is svchost.exe with a known scheduled task name (identifiable