PUA - Memory Dump Mount Via MemProcFS

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.

2026-04-27 00:00:00

None

8a1b2c3d-4e5f-6789-abcd-ef1234567890

attack.credential-access attack.t1003 attack.t1003.001 attack.t1003.004 attack.t1003.002

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5829 from @swachchhanda000 - Add `PUA - Memory Dump Mount Via MemProcFS`

2026-04-28