Suspicious LSASS Access Via MalSecLogon

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.