Credential Dumping via LSASS Access

Kush rana@Kushblueteamer

•updated 24 days ago•1•0•3

Detects potential credential dumping activities by monitoring process executions associated with known tools (Mimikatz, Procdump, Gsecdump) or commands that interact with the LSASS process memory to extract secrets.