AN0757
Analytic 0757
Windows
Detects anomalous process access to LSASS on domain controllers, suspicious module loads of authentication DLLs, and registry or file modifications indicative of Skeleton Key–style patching. Correlates LSASS access attempts with subsequent abnormal logon activity patterns.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=7
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:System
Unexpected modification to lsass.exe or cryptdll.dll
[MonitoredDLLs]
Specific authentication DLLs such as cryptdll.dll and samsrv.dll monitored for tampering.
[TimeWindow]
Correlation window between LSASS memory access, module load, and suspicious logons.
[UserContext]
Baseline expected accounts performing domain controller logon operations.