Suspicious LSASS Child Process (CVE-2026-41089 Netlogon RCE)

Tim Peck@timpeck

•updated Jun 2, 2026•15•0•69

This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.