(TargetImage:\\lsass.exe (GrantedAccess:0x1038* OR GrantedAccess:0x1438* OR GrantedAccess:0x143a* OR GrantedAccess:0x1fffff*) (CallTrace:dbgcore.dll* OR CallTrace:dbghelp.dll* OR CallTrace:kernel32.dll* OR CallTrace:kernelbase.dll* OR CallTrace:ntdll.dll*)) (-(SourceUser:AUTHORI* OR SourceUser:AUTORI*)) (-(((CallTrace:\:\\Windows\\Temp\\asgard2\-agent\\* CallTrace:\\thor\\thor64.exe\+* CallTrace:|UNKNOWN\(*) GrantedAccess:0x103800) OR SourceImage:\:\\Windows\\Sysmon64.exe))