Possible LSASS Process Dump Through Procdump (via process_creation)

This rule detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule flags anomalous command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers frequently dump LSASS memory to extract credentials for lateral movement and privilege escalation.