Credential Dumping Attempt via WerFault on LSASS
This rule detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process using `WerFault.exe`. It specifically looks for `WerFault.exe` accessing `lsass.exe` with a specific access mask (`0x1FFFFF`), which is indicative of memory dumping tools like Mimikatz, NanoDump, Invoke-Mimikatz, Procdump, or Taskmgr. This technique is often used by adversaries to extract credentials for lateral movement or persistence.
YARA-L
