Procdump Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 25, 2025•1•0•14

Detects the execution of the SysInternals Procdump utility. Procdump can be used by adversaries to dump process memory, including sensitive processes like LSASS, for credential access.