Potential Credential Dumping Via LSASS SilentProcessExit Technique

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•0•1

Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process