LSASS Access From Program In Potentially Suspicious Folder — Detection Rule

Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder