Mimikatz LSASS credential dumping via sekurlsa and VM_READ handle access
This rule detects potentially malicious access to the Local Security Authority Subsystem Service (LSASS) process (lsass.exe). It correlates events where a process requests sensitive access rights (0x1010 or PROCESS_VM_READ) to LSASS with other activities indicating the presence of Mimikatz or related credential dumping tools (e.g., presence of 'mimikatz' or 'sekurlsa' in process names or command lines).
Microsoft Sentinel (KQL)
