Unsigned Image Loaded By LSASS
This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
Unsigned Image Loaded By LSASS Help
This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named
Open in Search