LSASS Access From Program In Potentially Suspicious Folder
Detects suspicious process access to the Local Security Authority Subsystem Service (LSASS) memory. The rule specifically looks for processes attempting to access LSASS with certain access flags from potentially suspicious folders like temporary directories or user application data folders. This behavior is indicative of credential dumping attempts, often performed by malware or attackers to harvest credentials.
Sigma
