https://www.elastic.co/guide/en/security/current/prebuilt-rule-8-19-7-lsass-memory-dump-handle-access.html
LSASS Memory Dump Handle Access | Elastic Security [8.19] | Elastic
lsass memoryelastic securitydumphandleaccess
https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/credential_access_suspicious_lsass_access_memdump
Potential Credential Access via LSASS Memory Dump | Prebuilt detection rules reference
Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method...
credential accesslsass memorydetection rulespotentialvia