add ProcDump-based LSASS memory dump detection

nursery/dump-lsass-memory-via-minidumpwritedump.yml

@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: dump LSASS memory via MiniDumpWriteDump
+    namespace: collection/credential-dumping
+    authors:
+      - akshatpal
+    scopes:
+      static: function
+      dynamic: span of calls
+    att&ck:
+      - Credential Access::OS Credential Dumping::LSASS Memory [T1003.001]
+    references:
+      - https://attack.mitre.org/techniques/T1003/001/
+      - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
+    examples:
+      - 91a12a4cf437589ba70b1687f5acad19
+  features:
+    - and:
+      - match: create process memory minidump
+      - optional:
+        - string: /\\?lsass(\.exe)?/i

nursery/dump-lsass-memory-via-procdump.yml

@@ -0,0 +1,25 @@
+rule:
+  meta:
+    name: dump LSASS memory via ProcDump
+    namespace: collection/credential-dumping
+    authors:
+      - akshatpal
+    scopes:
+      static: function
+      dynamic: span of calls
+    att&ck:
+      - Credential Access::OS Credential Dumping::LSASS Memory [T1003.001]
+    references:
+      - https://attack.mitre.org/techniques/T1003/001/
+      - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
+      - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Procdump/
+  features:
+    - and:
+      - match: host-interaction/process/create
+      - string: /(?:sysinternals\\)?procdump(64)?(\.exe)?/i
+      - string: /lsass(\.exe)?/i
+      - or:
+        - string: / -ma(\s|$)/i
+        - string: / -mm(\s|$)/i
+        - string: / -mp(\s|$)/i
+        - string: /\.dmp(\s|$)/i