Potential SysInternals ProcDump Evasion for Credential Dumping

SigmaHQ Detections@sigmaHQ

•updated Apr 25, 2025•1•0•24

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output (specifically LSASS memory dumps) get renamed, or a dump file is moved or copied to a different name. This behavior is often used by adversaries to evade detection when performing credential dumping.