Process-Cloning - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/process-cloning/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 02:51:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPotential Credential Dumping via LSASS Process Cloninghttps://feed.craftedsignal.io/briefs/2026-11-lsass-clone/Tue, 10 Nov 2026 02:51:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-lsass-clone/Adversaries may perform credential dumping by spawning a clone of the Local Security Authority Subsystem Service (LSASS) process.Detection of a suspicious LSASS process clone that could be a sign of credential dumping activity. This technique involves an instance of the lsass.exe process being spawned by another lsass.exe process.

Recommendation

  • Deploy the Sigma rule (ID: c8da0dfd-4ed0-4b68-962d-13c9c884384e) to detect process creation events where lsass.exe is the parent of another lsass.exe instance.
]]>highadvisorycredential-accesslsassprocess-cloning