Wazuh SIEM lab detecting lsass credential access using Sysmon Event ID 10 and a custom rule targeting PROCESS_ALL_ACCESS (0x1FFFFF). Built in Proxmox homelab.
incident-response sysmon siem homelab wazuh blue-team mitre-attack windows-security lsass detection-engineering credential-access t1003
-
Updated
May 7, 2026