Indicator_MiniDumpWriteDump

YARA detection rule by Obscurity Labs LLC · Unknown

Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

import "pe"
rule Indicator_MiniDumpWriteDump : MiniDumpWriteDump
{
    meta:
        author                       = "Obscurity Labs LLC"
        description                  = "Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references"
        date                         = "2025-06-06"
        version                      = "1.0.1"
        yarahub_author_twitter       = "@obscuritylabs"
        yarahub_reference_md5        = "c3fc97f82241d6d91c6d037190b3753c"
        yarahub_uuid                 = "90626ac0-e544-4d5b-b8c3-e70a7feb2b75"
        yarahub_license              = "CC BY-NC 4.0"
        yarahub_rule_matching_tlp    = "TLP:WHITE"
        yarahub_rule_sharing_tlp     = "TLP:WHITE"
        mitre_attack_tactic          = "TA0006"
        mitre_attack_technique       = "T1003"

    strings:
                $dll_name_plain  = "DbgHelp.dll"         nocase
        $proc_name_plain = "MiniDumpWriteDump"   nocase
        
                $dll_name_xor    = "DbgHelp.dll"         xor wide ascii
        $proc_name_xor   = "MiniDumpWriteDump"   xor wide ascii
        
                $dll_name_b64    = "DbgHelp.dll"         base64
        $proc_name_b64   = "MiniDumpWriteDump"   base64

    condition:
        (
                        pe.is_pe and pe.imports("DbgHelp.dll", "MiniDumpWriteDump")
        )
        or
        (
                        any of ($dll_name_plain, $dll_name_xor, $dll_name_b64)                 and
            any of ($proc_name_plain, $proc_name_xor, $proc_name_b64)            )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c9a3b7db-7035-4ac8-b6d0-e35e6f475dce

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion