Sqldumper.exe Process Memory Dump
This rule detects the use of the legitimate Microsoft SQL Server utility `sqldumper.exe` to dump process memory. Specifically, it looks for `sqldumper.exe` being executed with command-line arguments that indicate an attempt to dump a process, such as '0x0110' or '0x01100:40'. This technique can be abused by attackers to dump sensitive processes like LSASS (Local Security Authority Subsystem Service) to extract credentials.
Sigma
