Access to LSASS memory
lsass.exe holds the credentials of logged-on users, so reading its memory is a common way to steal them. Five recordings show it: two in-memory credential dumps run from PowerShell, a dump through comsvcs.dll MiniDump, a tool that dumps through direct system calls, and a dump created from Task Manager. Many legitimate programs open lsass.exe too: services, installers, update agents. Find the accesses that belong to the five dumps.
Hint 1
GrantedAccess is the access mask the process asked for. Compare the masks of the dumps with those of the installers and update agents in the data.
Hint 2
CallTrace lists the modules on the stack when the access happened. UNKNOWN means code that does not belong to a loaded module.
The rule runs in this browser; it is saved here so you can come back to it.
Events
4,359 events. Search filters the table; it does not affect the result.