Suspicious LSASS Child Process (CVE-2026-41089)
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) spawns unexpected command shells or script interpreters. This is a strong indicator of post-exploitation activity following CVE-2026-41089 exploitation.
Microsoft Sentinel (KQL)
