Procdump Execution Targeting LSASS

Danny Y@zendannyy

•updated Jun 13, 2026•0•0•13

Detects the execution of Procdump targeting the Local Security Authority Subsystem Service (LSASS) process. This activity is commonly associated with credential dumping, where an attacker attempts to extract sensitive authentication material (like passwords or hashes) from memory.