Potential KslKatz Credential Dumping - KslD Service Tampering
This rule detects suspicious modifications to the KslD service registry keys, specifically targeting 'AllowedProcessName' or 'ImagePath' values. The detection logic looks for specific strings in the modified registry data that are indicative of KslKatz credential dumping activities, such as temporary driver paths, user profile paths, or temporary directory paths. This activity is often associated with enabling kernel read of LSASS memory for credential dumping.
Sigma
