YLog crash-dump artifact written after EngineerModeActivity session
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
Microsoft Sentinel (KQL)
