Suspicious Kernel Dump Using Dtrace
Detects the use of dtrace.exe to perform a kernel dump on Windows systems. This activity is suspicious as dtrace.exe is a legitimate debugging tool that can be abused for system information discovery or credential access by dumping kernel memory.
Sigma
