Grouped by Detection Method
Observe general process behavior with the goal of understanding normal and detecting anomalies. Use of multiple visualizations, tables, and aggregation methods is recommended. Any confirmed malicious behavior from this use case should be considered as a foundation for a new alert.
- Process accesses %WINDIR%\System32\lsass.exe
- Newly observed Source Process and Destination Process
- Sysmon Event ID 10