Detects potential mimikatz-like tools accessing LSASS from non system account
Read the full analysis on IntelFusions