PwDump 6 variant

Hunt Hypothesis

This detection identifies adversaries executing a PwDump 6 variant to extract credential hashes from memory, a critical step often used to facilitate lateral movement or privilege escalation within an Azure environment. Proactively hunting for this behavior in Azure Sentinel is essential because successful password dumping frequently precedes large-scale compromise, allowing the SOC team to intervene before attackers leverage stolen credentials to establish persistent access.

YARA Rule

rule PwDump
{
	meta:
		description = "PwDump 6 variant"
		author = "Marc Stroebel"
		date = "2014-04-24"
		score = 70
	strings:
		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
	condition:
		all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the PwDump 6 variant detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Credential Backup via PowerShell

  • Context: An automated nightly maintenance job uses PowerShell to export Active Directory user credentials or service account passwords to a secure backup location. This often involves reading the LSASecrets registry key or utilizing the Get-ADUser cmdlet with specific flags that mimic PwDump behavior.
  • Filter/Exclusion: Exclude processes running under the context of known maintenance accounts (e.g., DOMAIN\BackupSvc) executing powershell.exe on a scheduled basis between 02:00 and 04:00 UTC, specifically where the command line contains keywords like -Command "Get-ADUser" or references to specific backup script paths.

• Scenario: Legitimate Admin Tool Execution (LAPS & MDT)

  • Context: Administrators using Microsoft LAPS (Local Administrator Password Solution) or MDT (Microsoft Deployment Toolkit) often trigger PwDump-like signatures when the LapsService or deployment agents read local SAM database secrets to rotate passwords or configure new endpoints.
  • Filter/Exclusion: Create an exclusion for process names lapsadmin.exe, mdtutil.exe, and ntdsutil.exe running under the SYSTEM account, provided the parent process is a known management service (e.g., svchost.exe with specific service names like LapsSvc).

• Scenario: Third-Party Password Management Solutions

  • Context: Enterprise password vaults such as BeyondTrust, CyberArk, or Thycotic Secret Server agents periodically scan local machines to harvest credentials. These agents often invoke native Windows APIs that trigger the PwDump