hard20 pts · first answer countssysmonedrmitre-attack
Suspicious access to LSASS
What does this Sysmon event most likely show?
EventID: 10 ProcessAccess SourceImage: C:\Users\Public\svch0st.exe TargetImage: C:\Windows\System32\lsass.exe GrantedAccess: 0x1010
Discussion 0
Join free to post in the discussion.
Related questions
- What is Sysmon Event ID 1?Cybersecurity Analyst
- Tactic vs technique in MITRE ATT&CKCybersecurity Analyst
- Suspicious process tree in EDRCybersecurity Analyst
- Security log cleared on a serverCybersecurity Analyst
- A suspicious scheduled taskCybersecurity Analyst
- What EDR host isolation doesCybersecurity Analyst
- A good threat hunting hypothesisCybersecurity Analyst
- First move on an encrypting hostCybersecurity Analyst