LSASS Memory Access by Process with 'dump' Keyword in Name
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory by other processes. Specifically, it triggers when a process attempts to open lsass.exe and the accessing process's image name (full path) contains the keyword "dump". This behavior is indicative of tools used for credential dumping, such as Mimikatz or similar utilities, which often include "dump" in their filenames or paths.
YARA-L
