What is a one sentence summary of your feature request?
Add the ability to prevent LSASS.exe process cloning on Domain Controllers
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
Process cloning is a potential way malicious actors can circumvent LSASS Guardian and other protections on the LSASS process. If Threat Prevention had the ability to prevent process cloning or the ability to protect the cloned LSASS process, this would stop attackers in their tracks.
How do you currently solve the challenges you have by not having this feature?
The only way to solve this problem today would be with a solution on the Domain Controller to monitor use of tools that can be leveraged to perform process cloning and potentially block them.