Lsassy LSASS Dump via OpenProcess with SMB Admin Share Correlation
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
Microsoft Sentinel (KQL)
