HackTool - Doppelganger LSASS Dumper Execution
Detects the execution of the Doppelganger hacktool, which is designed to dump LSASS memory by cloning processes to evade common detection methods. The rule identifies this activity by looking for specific executable names or known ImpHash values associated with the Doppelganger tool.
Sigma
