car.2019-04-004 | Detection.FYI

Potentially Suspicious AccessMask Requested From LSASS

Nov 1, 2024 · attack.credential-access car.2019-04-004 attack.t1003.001 ·
Share on:

Detects process handle on LSASS process with certain access mask

Read More
Mimikatz Use

Aug 12, 2024 · attack.s0002 attack.lateral-movement attack.credential-access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More