LSASS Process Memory Dump Creation Via Taskmgr.EXE

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•1•0•24

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, a common technique for credential access.