Detects all QuarksPWDump versions

Hunt Hypothesis

This detection identifies adversary execution of Quarkslab’s pwdump utility across all versions to extract NTLM hashes from memory for offline credential cracking. Proactively hunting for this behavior in Azure Sentinel is essential because successful hash extraction often precedes lateral movement and privilege escalation, allowing the SOC team to mitigate potential domain compromise before attackers leverage stolen credentials.

YARA Rule

rule QuarksPwDump_Gen : Toolkit  {
	meta:
		description = "Detects all QuarksPWDump versions"
		author = "Florian Roth"
		date = "2015-09-29"
		score = 80
		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
	strings:
		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
		$s2 = "%d dumped" fullword ascii
		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
		$s4 = "\\SAM-%u.dmp" fullword ascii
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 4 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects all QuarksPWDump versions rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Password Policy Audits by IT Operations

  • Scenario: The IT Security team runs a weekly scheduled job using a custom PowerShell script (e.g., Audit-PasswordComplexity.ps1) that invokes the QuarksPWDump utility to extract password hashes from domain controllers for compliance reporting. This occurs every Sunday at 02:00 UTC across all Domain Controllers in the production forest.
  • Suggested Filter/Exclusion: Create a whitelist rule excluding alerts where the Source IP matches the known management subnet (e.g., 10.50.10.0/24) and the Process Name is specifically pwdump.exe launched by the user account svc-audit-job.

• Third-Party Identity Governance Tool Deployment

  • Scenario: The organization utilizes SailPoint IdentityIQ for lifecycle management. During its nightly synchronization cycle, the SailPoint agent on the jump servers executes QuarksPWDump to capture current password states before applying new role-based access control (RBAC) policies. This involves legitimate administrative activity rather than lateral movement or credential dumping by an attacker.
  • Suggested Filter/Exclusion: Exclude detections where the Parent Process is identified as java.exe (specifically the SailPoint agent JRE path, e.g., C:\Program Files\SailPoint\agent\bin\java.exe) and the execution time falls within the defined maintenance window (23:00 to 05:00 local server time).

• Endpoint Security Agent Health Checks

  • Scenario: The enterprise endpoint protection solution, CrowdStrike Falcon, performs a periodic health check on critical identity