Detects when a process tries to access the memory of svchost to potentially dump credentials.
Read the full analysis on IntelFusions