All Detections

LSASS credential dump with LSASSY (kernel access)

SIGMA Detection Rules@SIGMADetectionRules
updated Sep 6, 202504

Detects scenarios where an attacker remotely dump LSASS credentials using the LSASSY tool.

Sigma