NovaSky 9b010033d5 feat(chokepoint): add LSASS Credential Dumping (T1003.001) ...

New chokepoint covering the kernel-mediated handle request to lsass.exe,
the invariant prerequisite for all credential dumping tools.

- Chokepoint YAML with 3 stages, 24 variations, 7 evolution timeline entries
- Research sigma rule: baseline all non-system LSASS access (process_access)
- Hunt sigma rule: CallTrace + source path behavioral filtering
- Analyst sigma rule: triple-AND (access mask + dump mechanism + non-standard path)
- Emulation script with SeDebugPrivilege handling and PPL detection
- 4 raw log samples, 6 OSINT pivots, CHANGELOG updated

2026-03-30 16:29:09 -04:00

..

browser-credential-theft

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00

byosi-scripting-interpreters

feat(chokepoint): add BYOSI Scripting Interpreters detection chokepoint

2026-03-29 04:35:09 +00:00

clickfix-techniques

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00

edr-bypass-techniques

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00

lsass-credential-dumping

feat(chokepoint): add LSASS Credential Dumping (T1003.001)

2026-03-30 16:29:09 -04:00

ransomware-service-manipulation

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00

remote-execution-tools

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00

renamed-rmm-tools

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00

web-shells

Strip emulation script doc blocks and add two-line ATT&CK headers

2026-03-22 16:15:10 +00:00