SimpleHelp - LSASS Credential Dumping
Detects the SimpleHelp process (identified by JWrapper) attempting to open the LSASS process, which is a common technique for credential dumping. This rule specifically looks for process access events where the target is 'lsass.exe' and the initiating process is associated with SimpleHelp.
Microsoft Sentinel (KQL)
