Strings Command on Process Memory
Detects the 'strings' command being run directly against /proc/*/mem to extract human-readable strings (such as tokens or passwords) from raw memory. This activity is often associated with credential dumping techniques on Linux systems.
Microsoft Sentinel (KQL)
