Outflank Dumpert LSASS Memory Dump File Creation
This rule detects the creation of a file named 'dumpert.dmp' which is the default output file name used by the Outflank Dumpert tool. Outflank Dumpert is a known tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process, typically for credential harvesting.
YARA-L
