A Sigma rule for LSASS credential access targets the single most valuable move in a Windows intrusion: a process opening lsass.exe ...
Sigma Rule for LSASS Credential Access (Event ID 10)
From Logs to Threats: SIEM Correlation Rules for Real Attacks
