SafetyKatz LSASS Dump File Detection
Detects the creation of a file named 'debug.bin' in the '\Temp\' directory, which is the default output filename used by the SafetyKatz tool for dumping LSASS memory. This activity is indicative of an attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.
Sigma
