Unsigned Image Loaded By LSASS
This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
This content is not mapped to any local saved search. Add mapping
Unsigned Image Loaded By LSASS Help
This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named
Open in Search