Threat Hunt: Suspicious LSASS Access & Credential Dumping

Awais Munir@iawais

•updated Jul 24, 2025•9•2•82

Detects instances where sensitive process lsass.exe is accessed by potentially malicious or abused utilities like powershell.exe, cmd.exe, rundll32.exe, or wmic.exe, which may indicate credential dumping or reconnaissance activity. It also captures admin tools commonly abused for credential dumping, including memory dump indicators via DLLs like comsvcs.dll.