WerFault LSASS Process Memory Dump

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials