Magnet DumpIt memory dump creation for credential extraction

Ankit Mehta@Secvyn

•updated 21 days ago•0•0•1

This rule detects activities associated with suspicious credential dumping and lateral movement tool usage, specifically targeting 'DumpIt.exe' for memory dumping, 'dokan.exe' for potential driver installation, and the creation of known suspicious files like 'memfix.zip' or 'Server.raw'. These actions are commonly indicative of post-exploitation credential harvesting and preparation for exfiltration.