Abuse of CreateDump Utility for Credential Access

The Windows utility createdump.exe, typically associated with the .NET runtime, is being leveraged by threat actors as a living-off-the-land binary (LOLBIN) to facilitate credential access. By invoking this utility, attackers can capture the memory contents of sensitive processes, such as lsass.exe, without triggering traditional file-based malware detections. The utility provides command-line arguments to specify the target process and output file, allowing for stealthy exfiltration of credentials. This technique is particularly effective in environments where .NET components are prevalent, as the binary is often present and trusted by security controls. Defenders should focus on process execution patterns associated with command-line flags that indicate memory dumping, rather than relying on binary reputation alone.

Impact

Successful abuse of createdump.exe results in the unauthorized dumping of sensitive process memory, leading to the potential theft of credentials, tokens, or secret keys stored in volatile memory. This enables subsequent lateral movement, privilege escalation, and persistent access within a compromised Windows environment.

Recommendation

Deploy the provided Sigma rule to identify suspicious executions of createdump.exe with dump-specific command-line arguments. Monitor for processes spawning createdump.exe where the target is a security-sensitive process like lsass.exe, and restrict the use of this utility to verified administrative or diagnostic workflows using application control solutions.