LSASS Process Access with Read Permissions
Detects attempts to open the Local Security Authority Subsystem Service (LSASS) process with read permissions (specifically, PROCESS_VM_READ access) by non-system processes. This activity is often associated with credential dumping techniques.
Microsoft Sentinel (KQL)
