id: 55db307d-4a36-4594-bea8-7d114714d3b4
description: N/A
date: 2025-10-24
author: SigmaHQ Team
rule_metadata:
    - id: 69ca12af-119d-44ed-b50f-a47af0ebc364
      title: LSASS Process Memory Dump Creation Via Taskmgr.EXE
regression_tests_info:
    - name: Positive Detection Test
      type: evtx
      provider: Microsoft-Windows-Sysmon
      match_count: 1
      path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/69ca12af-119d-44ed-b50f-a47af0ebc364.evtx
