Potential LSASS Process Dump via Procdump
Detects suspicious uses of the SysInternals Procdump utility by using specific command line parameters (`-ma` or `-mm`) in combination with the `lsass.exe` process. This rule aims to catch instances where an attacker might rename the Procdump executable but still uses its characteristic command-line arguments to dump LSASS memory. It covers scenarios described in atomic tests 1 and 8 related to Procdump memory dumping.
YARA-L
