GDB Memory Dumping of Runner.Worker

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•1

Detects the use of the GNU Debugger (gdb) to dump process memory (gcore) to disk, a technique abused by attackers to extract credentials residing in Runner.Worker. The rule specifically looks for process creation events where 'gdb' is in the command line along with process ID flags ('-p' or '--pid') and memory dumping commands ('dump memory' or 'gcore').