Suspicious Kernel Dump Using Dtrace

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•0

Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1