LSASS Process Memory Dump Creation Via Taskmgr.exe
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, which is a common technique for credential access.
YARA-L
