Detect Credential Dumping through LSASS access

LSASS Memory, OS Credential Dumping

Unusually Long Command Line - MLTK

Web Servers Executing Suspicious Processes

System Information Discovery

Processes Tapping Keyboard Events

Samsam Test File Write

Data Encrypted for Impact