diff --git a/nursery/dump-lsass-memory-via-openprocess-and-minidumpwritedump.yml b/nursery/dump-lsass-memory-via-openprocess-and-minidumpwritedump.yml
new file mode 100644
index 000000000..43efa5b1b
--- /dev/null
+++ b/nursery/dump-lsass-memory-via-openprocess-and-minidumpwritedump.yml
@@ -0,0 +1,30 @@
+rule:
+  meta:
+    name: dump LSASS memory via OpenProcess and MiniDumpWriteDump
+    namespace: collection/credential-dumping
+    authors:
+      - akshatpal
+    scopes:
+      static: function
+      dynamic: span of calls
+    att&ck:
+      - Credential Access::OS Credential Dumping::LSASS Memory [T1003.001]
+    references:
+      - https://attack.mitre.org/techniques/T1003/001/
+      - https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess
+      - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
+  features:
+    - and:
+      - or:
+        - match: open process
+        - api: kernel32.OpenProcess
+        - api: NtOpenProcess
+        - api: ZwOpenProcess
+      - or:
+        - match: create process memory minidump
+        - api: dbghelp.MiniDumpWriteDump
+      - or:
+        - substring: "lsass.exe"
+        - substring: "\\lsass.exe"
+      - optional:
+        - match: acquire debug privileges