Update sysmon_lsass_memdump.yml

rules/windows/sysmon/sysmon_lsass_memdump.yml

@@ -1,6 +1,6 @@
 title: LSASS Memory Dump
 status: experimental
-description: Detects process LSASS memory dump using procdump or taskmgr based on the CallTrace pointing to dbghelp.dll
+description: Detects process LSASS memory dump using procdump or taskmgr based on the CallTrace pointing to dbghelp.dll or dbgcore.dll for win10
 author: Samir Bousseaden
 references:
     - https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
@@ -16,7 +16,9 @@ detection:
         EventID: 10
         TargetImage: 'C:\windows\system32\lsass.exe'
         GrantedAccess: '0x1fffff'
-        CallTrace: '*dbghelp.dll*'
+        CallTrace:
+         - '*dbghelp.dll*'
+         - '*dbgcore.dll*'
     condition: selection
 falsepositives:
     - unknown