Suspicious Process Access to LSASS (Credential Dumping T1003.001)

Ibrahim Saud@tektrix

•updated 6 days ago•0•0•0

Detects instances where a process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS.exe) with suspicious access rights often associated with credential dumping. The rule excludes known benign processes such as antivirus and debugging tools.