Suspicious Cross-Process Handle Access to LSASS or Winlogon

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.