Potential Credential Dumping Via LSASS SilentProcessExit Technique

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process