Mimikatz - LSASS Process Access
Detects tools like Mimikatz, NanoDump, Procdump, or Invoke-Mimikatz accessing the LSASS process with specific memory read permissions (PROCESS_VM_READ). This detection relies on Sysmon Event ID 10 and filters out legitimate svchost.exe access to LSASS.
Sigma
