Lsass Full Dump Request Via DumpType Registry Settings

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS.