Memory Dump File Creation Detection
This rule detects the creation of files with the '.dmp', '.dump', or '.hdmp' extensions. These files are typically memory dumps generated by software during a crash. While often legitimate, memory dumps can contain sensitive information, including credentials, which could be exploited by adversaries. The rule aims to identify instances where such files are created to allow for investigation into the cause of the crash and to ensure no sensitive data is exposed or exfiltrated.
Sigma
