Skip to content
Threat Feed
Subscribe

Product

Local Security Authority Subsystem Service (Lsass.exe)

1 brief RSS
medium advisory

Detection of Unauthorized Lsass.exe Process Termination

Detection of malicious processes attempting to terminate the Local Security Authority Subsystem Service (lsass.exe) using the PROCESS_TERMINATE access mask to facilitate system instability or disable security controls.

Local Security Authority Subsystem Service defense-evasion credential-access windows sysmon
1r