All Detections

LSA Secrets Dumped via Remote Registry

avatar
Darshan Thummar@Mighty
updated Jun 16, 2026107

Detects access to LSA Secrets stored in registry for service account credentials

Microsoft Sentinel (KQL)