rare legitimate files with similar filename structure

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_safetykatz.yml>sigma
technicques: t1003 t1003.001

Techniques

Detects default lsass dump filename generated by SafetyKatz.

condition: selection
selection:
  TargetFilename|endswith: \Temp\debug.bin