Skip to content
.evtx

Posts tagged "{tag}": #credential-theft

← ← Back to blog
Sysmon Event IDs 8 and 10: process injection and LSASS access
Detecting code injection and credential theft with Sysmon — CreateRemoteThread (8) and ProcessAccess (10), reading GrantedAccess masks against lsass.exe, and using the call trace to find unsigned modules.
evtxdfirsysmoncredential-theft