Unsigned Image Loaded Into LSASS Process — Detection Rule

Loading unsigned image (DLL, EXE) into LSASS process

Read the full analysis on IntelFusions