UNC6692 - LSASS Memory Dumping via TaskMgr
Identifies Task Manager spawning dumps of the LSASS process space, which are subsequently staged in temporary locations. This activity is associated with the UNC6692 threat group.
Microsoft Sentinel (KQL)
Identifies Task Manager spawning dumps of the LSASS process space, which are subsequently staged in temporary locations. This activity is associated with the UNC6692 threat group.
Already have an account?