062. A Few Ways to Detect a Dumping Tool from a Ransomware Gang's Toolset
Hello everyone! Today we'll look at another tool from a ransomware gang's toolkit. It's called MiniDump , and it enables adversaries to dump LSASS or any other process. Let's look at a few detection opportunities. The tool drops and loads a driver with the following name - kxxxxxxx.sys . It means we can search for creation events related to it: event_type: "filecreate" AND file_name: "kxxxxxxx.sys" MiniDump also creates a service with the same name - another detection opportunity: event_type: "serviceuninstallwin" AND service_name: "kxxxxxxx.sys" Finally, the tool loads the driver: event_type: "driverloadwin" AND file_name: "kxxxxxxx.sys" AND file_sig: "DFOCUS Co., Ltd" Interesting enough that the driver name is the same as in the EDR killer advertised some time ago by threat actor with moniker "r1z". See you tomorrow!