MITRE CAR unknown stable spl

Create Remote Thread into LSASS

Actors may create a remote thread into the LSASS service as part of a workflow to dump credentials.

View Source

Detection Logic

`sysmon` EventID=8 TargetImage=*lsass.exe
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId
| rename Computer as dest

Field Validations

Loading…

Comments (0)

Loading comments...