LSASS handle leak via Seclogon

Identifies suspicious access to LSASS process from a callstack pointing to seclogon.dll that may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Acceso a credenciales
• Técnicas MITRE: T1003, T1003.001

Volver a todas las reglas