Credential Dumping Attempt Via WerFault

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•0

Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up