LSASS Process Memory Dump Files

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•1

Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials