LSA PPL Protection Setting Modification via CommandLine

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.