labmwr l
@labmwr0 followers11 downloads2 copies0 likes27 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
Detects the execution of the Windows error reporting tool 'createdump.exe' with command-line arguments referencing 'lsass.exe' or the '--full' flag, which is commonly used by adversaries to perform credential dumping from the Local Security Authority Subsystem Service (LSASS) process memory.
