Netlogon/LSASS Process Instability (CVE-2026-41089)
Monitors for unexpected process termination or instability events associated with the Windows Netlogon service or lsass.exe (Event IDs 1000, 7031, 7034). This may indicate a failed buffer overflow exploitation attempt related to CVE-2026-41089, which could lead to a denial of service.
Cortex XDR
