Antivirus Password Dumper Detection (78cc2dd2-7d20-4d32-93ff-057084c38b93)

Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
LSASS Memory - T1003.001 (65f2d882-3f41-4d48-8a06-29af77ec9f90)	Attack Pattern	Antivirus Password Dumper Detection (78cc2dd2-7d20-4d32-93ff-057084c38b93)	Sigma-Rules	1
Antivirus Password Dumper Detection (78cc2dd2-7d20-4d32-93ff-057084c38b93)	Sigma-Rules	Security Account Manager - T1003.002 (1644e709-12d2-41e5-a60f-3470991f5011)	Attack Pattern	1
Antivirus Password Dumper Detection (78cc2dd2-7d20-4d32-93ff-057084c38b93)	Sigma-Rules	Steal or Forge Kerberos Tickets - T1558 (3fc01293-ef5e-41c6-86ce-61f10706b64a)	Attack Pattern	1
Antivirus Password Dumper Detection (78cc2dd2-7d20-4d32-93ff-057084c38b93)	Sigma-Rules	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	1
LSASS Memory - T1003.001 (65f2d882-3f41-4d48-8a06-29af77ec9f90)	Attack Pattern	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	2
Security Account Manager - T1003.002 (1644e709-12d2-41e5-a60f-3470991f5011)	Attack Pattern	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	2