Detects procdump execution targeting lsass.exe

nomit vyas@xoxo

•updated Jun 22, 2026•0•0•7

Detects procdump execution targeting lsass.exe A variation of https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19