LSASS Memory Access via Credential Dumping (Mimikatz/ProcDump/MiniDump)
Detects attempts to dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory using common tools like Mimikatz, Procdump, or built-in system utilities such as comsvcs.dll or command-line arguments indicating memory dump operations.
Cortex XDR
