ClosedQuorum-style multi-source credential/wallet theft after LSASS access

Arnold Chan@slaz

•updated 13 days ago•6•0•4

Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.