LSASS access 0x1010 from mstsc.exe (Cobalt Strike injected process)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects the Remote Desktop client (mstsc.exe) attempting to open the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights (0x1010), which is indicative of credential dumping or process injection.