LSASS Process Memory Dump Creation Via Taskmgr.EXE

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•0

Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.