Potential Credential Dumping Via LSASS Process Clone
This rule detects the creation of a new process where both the parent process and the new process are 'lsass.exe'. This behavior is highly suspicious and indicative of credential dumping techniques, specifically attempts to clone the LSASS process to extract credentials without directly interacting with the original LSASS process, which might be protected by security solutions.
Sigma
