Nagios Support Forum

The Microsoft Attack Surface Reduction (ASR) rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" has highlighted that ncpa.exe is making calls to LSASS, or more specifically is trying to access LSASS.EXE process memory (LSASS: Local Security Aut...