From 9c111667af79007dc91c0b784179658984274285 Mon Sep 17 00:00:00 2001
From: S12cybersecurity <79543461+S12cybersecurity@users.noreply.github.com>
Date: Thu, 25 Sep 2025 21:55:58 +0200
Subject: [PATCH] Create process-dump.yar

---
 process-dump.yar | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 process-dump.yar

diff --git a/process-dump.yar b/process-dump.yar
new file mode 100644
index 0000000..fa3517f
--- /dev/null
+++ b/process-dump.yar
@@ -0,0 +1,16 @@
+import "pe"
+
+rule WIN_MiniDump_DbgHelp_Importer
+{
+    meta:
+        author      = "0x12 Dark Development"
+        description = "Detects PE files that import MiniDumpWriteDump from dbghelp.dll"
+        version     = "1.0"
+        date        = "2025-09-25"
+        reference   = "Detects explicit DbgHelp-based minidump capability"
+    tags = ["windows", "minidump", "dbghelp", "dfir", "edr"]
+
+    condition:
+        uint16(0) == 0x5A4D and pe.is_pe and
+        pe.imports("dbghelp.dll", "MiniDumpWriteDump")
+}