KQL_win_susp_lsass_dump.txt

SecurityEvent | where (EventID == "4656" and ProcessName == "C:\Windows\System32\lsass.exe" and AccessMask == "0x705" and ObjectType == "SAM_DOMAIN")