Alerts
Detections from the lab. Triage with j/k to move, enter to open, t/f/e to set a verdict.
| Rule | ATT&CK | Status | |||
|---|---|---|---|---|---|
SAMPLECredential dumping: C:\WINDOWS\system32\svchost.exe accessed LSASS memory #100010 | WORKSTATION-01 | T1003.001 | True positive | 4d | |
SAMPLEDiscovery: recon binary executed -> whoami.exe #100020whoami.exe | WORKSTATION-01 | T1033 | In progress | 4d |
Showing 2 alerts.