StrikeShark Pillager/CobaltStrike LSASS Memory Access via Suspicious GrantedAccess

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process using granted access rights associated with credential dumping tools like Pillager and Cobalt Strike, commonly observed in StrikeShark campaigns.