Suspicious LSASS memory access with read-capable rights
Detects processes attempting to open a handle to the Local Security Authority Subsystem Service (LSASS) process with read-capable access rights (0x1010 or 0x1410). These access rights are commonly associated with credential dumping tools like Mimikatz, which read LSASS process memory to extract credentials. Legitimate system processes such as wininit.exe and services.exe are excluded to reduce noise.
YARA-L
