SystemBC/Ransomware LSASS Credential Dump via MiniDump, Procdump, or Mimikatz
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
Splunk (SPL)
