01
detectionlint / library / yara-l
lsass_process_memory_dump_file_creation
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials