Potential Credential Dumping Attempt Via PowerShell Remote Thread

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects remote thread creation by PowerShell processes into "lsass.exe"