LSASS Process Memory Dump File Creation
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
YARA-L
