LSASS Memory Read via PPL Bypass

api where process.Ext.api.name == "ReadProcessMemory" and Target.process.name == "lsass.exe" and
 Target.process.Ext.protection == "PsProtectedSignerLsa-Light" and process.executable != null and
  process.pid != 4 and not process.Ext.protection like "PsProtectedSigner*" and
  process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
  not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Undetermined") and
  not (process.executable : "?:\\Program Files\\Sophos\\Sophos File Scanner\\SophosFileScanner.exe" and
       process.code_signature.subject_name : "Sophos Ltd" and process.code_signature.trusted == true and 
       (process.thread.Ext.call_stack_final_user_module.path : "?:\\program files\\sophos\\sophos standalone engine\\*\\savi.dll" or
        process.thread.Ext.call_stack_final_user_module.name : ("Unknown", "Undetermined"))) and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 : "7db3c6b0aab47ccd44a2b0600808c94978e20bf10dcb5c5829b2eb1d66631f00" and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature,
                   $entry, $entry.subject_name : ("Sophos Ltd", "Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher", "Trend Micro, Inc.") and $entry.status : "trusted") and
  not (process.executable : "C:\\Windows\\System32\\WerFault.exe" and
       process.thread.Ext.call_stack_final_user_module.path in ("c:\\windows\\system32\\dbghelp.dll", "c:\\windows\\system32\\faultrep.dll", "c:\\windows\\system32\\wer.dll", "c:\\windows\\system32\\werfault.exe")) and
  not process.thread.Ext.call_stack_final_user_module.path like ("c:\\windows\\assembly\\nativeimages_*.ni.dll") and
  not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $caller, $caller.status == "trusted") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                          ("7dcaaa094cc504fbb1dbfc9e4c6a0727370c0cb2c7a3ba5d830a6a2f57ccb483",
                                           "1d6a20444b2dfb3719dbdd4fab61c94f3a799c0a91bb7a02ab527cbbae2dfb98",
                                           "ed4d6fdb6248bcff64e5652cd0c9d79c483bace94c1120dc3128645f00a5e5c4", 
                                           "f51b2842cd6263b5dbef652ac578628bf7706ae5e19853262e75dea212bac257")