Suspicious Child Process Spawned by LSASS

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•8

Detects suspicious child processes spawned by lsass.exe, which may indicate exploitation of the Netlogon service or credential dumping activity.