Thank you very much for your help For the rule is not so generic I recommend you add in "Local" "Application" C:\WINDOWS\system32\lsass.exe...
Separate names with a comma.