Suspicious Procdump Targeting LSASS

Danny Y@zendannyy

•updated Jul 21, 2026•6•0•11

Detects procdump execution targeting lsass.exe Kind of like https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19