LSASS Full Dump Request Via DumpType Registry Settings

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects the setting of the "DumpType" registry value to "2" (Full Dump) within the Windows Error Reporting LocalDumps configuration. This specific setting is required by techniques like LSASS Shtinkering to facilitate dumping of the LSASS process memory, which often contains sensitive credential material.