Suspicious LSASS Access Via MalSecLogon — Detection Rule

Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.

Read the full analysis on IntelFusions