LSASS Memory Access for Credential Dumping
Detects a process requesting read access (GrantedAccess 0x1010) to the LSASS process memory (lsass.exe). This technique is commonly used by threat actors to dump credentials for lateral movement and ransomware deployment. The rule specifically looks for the GrantedAccess value '0x1010', which corresponds to PROCESS_VM_READ and PROCESS_QUERY_INFORMATION access rights, and excludes a list of known legitimate processes.
Microsoft Sentinel (KQL)
