LSASS Dump Keyword In CommandLine

SigmaHQ Detections@sigmaHQ

•updated Sep 7, 2023•0•0•1

Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.