XORDump Execution for Credential Dumping

SigmaHQ Detections@sigmaHQ

•updated Apr 25, 2025•0•15

Detects the execution of the XORDump utility, a tool used for dumping process memory, specifically targeting LSASS or using common DLLs for memory dumping like comsvcs, dbghelp, or dbgcore. This activity is indicative of credential access attempts.