Potentially Suspicious AccessMask Requested From LSASS — Detection Rule

Detects process handle on LSASS process with certain access mask

Read the full analysis on IntelFusions