Remote LSASS Process Access Through Windows Remote Management

심각도 높음 Sigma 탐지 룰. Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

작성자: Patryk Prauze - ING Tech · 원본 라이선스: DRL 1.1 · SigmaHQ 원본