createdump.exe execution referencing lsass.exe

labmwr l@labmwr

•updated Jul 12, 2026•2•0•27

Detects the execution of the Windows error reporting tool 'createdump.exe' with command-line arguments referencing 'lsass.exe' or the '--full' flag, which is commonly used by adversaries to perform credential dumping from the Local Security Authority Subsystem Service (LSASS) process memory.