All Detections

Potential SysInternals ProcDump Evasion

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Sigma