Question

A CySA+ analyst reviewing Sysmon logs on a domain controller notices Event ID 10 (ProcessAccess) entries showing a non-standard process named 'svhost.exe' repeatedly opening handles to lsass.exe with the access mask 0x1010 (PROCESS_VM_READ and PROCESS_QUERY_INFORMATION). No legitimate administrative or backup tooling is scheduled at this time. Which malicious activity does this MOST likely indicate?

Accepted Answer

Credential dumping via memory access to the Local Security Authority Subsystem Service

Answer

A DLL side-loading attack that hijacks the legitimate svchost.exe binary

Answer

Kerberoasting through requesting service tickets for privileged accounts

Answer

A denial-of-service condition caused by resource exhaustion on the domain controller