LSASS Access From Potentially White-Listed Processes

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.