Suspicious LSASS process access

Identifies processes requesting high-privilege access to the Local Security Authority Subsystem Service (LSASS) process using access rights commonly required to read process memory, duplicate handles, or create process clone for dumping the credentials material.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Acceso a credenciales
• Técnicas MITRE: T1003, T1003.001

Volver a todas las reglas