Potential Credential Dumping Attempt Via PowerShell Remote Thread — Detection Rule

Detects remote thread creation by PowerShell processes into "lsass.exe"

Read the full analysis on IntelFusions