Potential PhantomCore or PhantomGraph Backdoor, LSASS Dumping, and Reverse SSH Activity

Syed Usfar Wasim@nCD24

•updated Aug 10, 2026•0•0•6

This query identifies creation/loading of SysExcSvc.dll and SysReadSvc.dll along with suspicious LSASS memory dumping, reverse SSH tunnel creation. These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.