Suspicious Kernel Dump Using Dtrace

심각도 높음 Sigma 탐지 룰. Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

작성자: Florian Roth (Nextron Systems) · 원본 라이선스: DRL 1.1 · SigmaHQ 원본