Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410
Read the full analysis on IntelFusions