All Detections

Potential SysInternals ProcDump Evasion

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Sigma