LSASS Memory Dump Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the delivery of a tool capable of dumping LSASS memory over HTTP. It specifically looks for the string "MiniDumpWriteDump" within HTTP response data, which is a function commonly used by tools to extract credentials from the LSASS process.