Process Memory Dump Via Dotnet-Dump

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.