WerFault LSASS Process Memory Dump — Detection Rule
Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials