Detects well-known credential dumping tools execution via service execution events
Read the full analysis on IntelFusions