UNC6692 LSASS Memory Dump via Task Manager
Detects Windows Task Manager (taskmgr.exe) requesting access to the Local Security Authority Subsystem Service (LSASS) process to dump memory. This Living-off-the-Land (LotL) technique was utilized by UNC6692 to extract credentials for subsequent pass-the-hash attacks against domain controllers.
Sigma
