Suspicious LSASS process access

Identifies processes requesting high-privilege access to the Local Security Authority Subsystem Service (LSASS) process using access rights commonly required to read process memory, duplicate handles, or create process clone for dumping the credentials material.

• Platform: Windows
• Severity: High
• MITRE Tactic: Credential Access
• MITRE Techniques: T1003, T1003.001

Back to all rules