Detect Credential Dumping through LSASS access

LSASS Memory , OS Credential Dumping

Prohibited Software On Endpoint

Unusually Long Command Line - MLTK

Suspicious File Write

Web Servers Executing Suspicious Processes

System Information Discovery