Suspicious Memory Dump Command Execution via Command Line

Ankit Mehta@Secvyn

•updated Jun 25, 2026•1•0•2

This rule monitors process execution events for the usage of common memory dumping utility names (e.g., procdump, memdump, coredump, crashdump) via command-line interfaces such as cmd.exe or powershell.exe. This activity is frequently associated with attackers attempting to dump sensitive process memory, such as LSASS, to extract credentials or other secrets from memory.