← Back to Explore
S0002
S0002
12
Detections
1
Sources
0
Threat Actors
BY SOURCE
12sigma
PROCEDURES (9)
Suspicious2 detections
Auto-extracted: 2 detections for suspicious
Dump2 detections
Auto-extracted: 2 detections for dump
Credential2 detections
Auto-extracted: 2 detections for credential
Mimikatz1 detections
Auto-extracted: 1 detections for mimikatz
Process Access1 detections
Auto-extracted: 1 detections for process access
Process Access1 detections
Auto-extracted: 1 detections for process access
Mimikatz1 detections
Auto-extracted: 1 detections for mimikatz
Credential1 detections
Auto-extracted: 1 detections for credential
Suspicious1 detections
Auto-extracted: 1 detections for suspicious
DETECTIONS (12)
Credential Dumping Attempt Via WerFault
sigmahigh
HackTool - Generic Process Access
sigmahigh
LSASS Access From Potentially White-Listed Processes
sigmahigh
LSASS Access From Program In Potentially Suspicious Folder
sigmamedium
LSASS Memory Access by Tool With Dump Keyword In Name
sigmahigh
Mimikatz Use
sigmahigh
Potential Credential Dumping Activity Via LSASS
sigmamedium
Potentially Suspicious GrantedAccess Flags On LSASS
sigmamedium
Remote LSASS Process Access Through Windows Remote Management
sigmahigh
Successful Overpass the Hash Attempt
sigmahigh
Suspicious Machine Account Replication - DcSync Indicator
sigmamedium
Uncommon GrantedAccess Flags On LSASS
sigmamedium