LSASS Dump File Creation Anomaly
Detects the creation of 'lsass.dmp' files outside of standard Windows Error Reporting (WER) or CrashDumps paths. This activity can indicate an attempt to dump LSASS memory for credential access.
Microsoft Sentinel (KQL)
