LSASS process access (potential credential dumping)
Alert details
Alert IDda637912300002
Created2026-08-18 20:07 UTC
Detection source-
Threat family-
SourceDemo
Entities
Device
corp-wks-1187
High riskHigh exposure
Userj.doe@propera.local
Related incidentINC-01001
Evidence
Process
Access to LSASS from unusual process
mimikatz.exe sekurlsa::logonpasswords
C:\Windows\Temp\mimikatz.exe
Auth
Failed logon followed by successful logon
