Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
Read the full analysis on IntelFusions