All Detections

DumpIt Memory Acquisition Execution

avatar
Brandon Rodriguez@BMRodriguez
updated May 22, 20263085

Identifies the execution of DumpIt, a memory acquisition tool often abused by attackers to dump LSASS and extract NTLM hashes or Kerberos tickets.

Microsoft Sentinel (KQL)