LSASS Process Memory Dump File Creation
Detects the creation of files with names commonly used by various memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. This includes specific filenames and patterns associated with tools like Procdump, MirrorDump, PPLBlade, RustiveDump, NativeDump, and Nanodump.
Sigma
