StrikeShark LSASS Dump via Pillager, comsvcs MiniDump, procdump, or ntdsutil
Detects common credential dumping techniques targeting the LSASS process or NTDS.dit database, including the use of known dump utilities such as Procdump, Rundll32 with comsvcs.dll, and Ntdsutil, as well as unauthorized process access to LSASS.
Splunk (SPL)
