LSASS Process Memory Dump Creation Via Taskmgr.exe

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•0

Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager