legitimate use of procdump by a developer or administrator

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_procdump.yml>sigma
technicques: t1003 t1003.001 t1036

Techniques

Detects usage of the SysInternals Procdump utility

condition: selection
selection:
  Image|endswith:
  - \procdump.exe
  - \procdump64.exe