All Detections

Suspicious LSASS Process Access

avatar
LeMagicKonch@LeMagicKonch
updated 6 days ago2010

Uses the Sysmon Event ID 10 to alert on process accesses of LSASS that are not normally seen within enterprise environments

Cortex XDR