1 item, newest first.
Sep 25, 2025
Detect LSASS dump with comsvcs.dll and rundll32. Clear command breakdown and Sigma mappings for Defender and Elastic
One lab-proven detection per issue: the attacker command, the telemetry it leaves, and the KQL / ES|QL that catches it.
You confirm on Substack in one tap.
No spam. Unsubscribe anytime.