BIOC
High
✕
Suspicious debug file created in a temporary folder
SharpDump and SafetyKatz are credential dumping tools that create minidumps for the process ID (PID) specified (LSASS by default) in C:\Windows\Temp\debug<PID>.bin.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: OS Credential Dumping (T1003)
Indicator:
File file path =~ \\temp\\debug[0-9]*\.bin AND action type = create
Preventable: yes