detecting-t1003-credential-dumping-with-edr