Process Memory Dump Via Dotnet-Dump
Detects the execution of "dotnet-dump" with the "collect" flag, which can indicate potential process dumping of critical processes like LSASS. This tool is part of the .NET Core diagnostics and can be legitimately used for debugging, but its use to collect memory dumps of sensitive processes could be malicious.
Sigma
