name: Out of order sequence
id: 272902be-76e9-4ee7-a48a-6275fa571cf4
version: 1.0.0
condition: >
  sequence
  by ps.uuid
  |kevt.name = 'OpenProcess'|
  |kevt.name = 'CreateFile' and file.operation = 'CREATE'
      and
  file.extension = '.dmp'
  |
output: >
  Detected an attempt by `%1.ps.name` process to access and read
  the memory of the **Local Security And Authority Subsystem Service**
  and subsequently write the `%2.file.name` dump file to the disk device
min-engine-version: 2.0.0
