Remote LSASS Process Access Through Windows Remote Management

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.