Skip to content
Threat Feed
Subscribe

Tag

Security-Event

1 brief RSS
medium advisory

Potentially Suspicious AccessMask Requested From LSASS

This brief describes the detection of suspicious access mask requests to the Local Security Authority Subsystem Service (LSASS) process, a common post-exploitation technique used by threat actors for credential dumping on Windows systems.

credential-dumping post-exploitation windows security-event
1r 1t