LSASS Dump Keyword In CommandLine

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•0

Detects the presence of the keywords lsass and .dmp in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process