Summary

On DSA version 20.0.0.6313, the Hidden Suspicious Section feature is now enabled globally. On DSA version 20.0.0.7119 and below however, an issue occurs that the LSASS dump is not being blocked.

Upon investigation, it was found out that:

• LSASS dump should be blocked by 5225D policy.
• The reason it cannot be detected is because parsing predefined token failed.