📋 Log Analysis
🔐 Daily Cyber Challenge
Thursday, 5 November 2026 · Challenge #309
🔥
0
Day streak
0
Solved
0
Best streak
Mimikatz Detection
Sysmon Event 10 (Process Access):
SourceImage: C:\Users\jdoe\Downloads\mimi.exe
TargetImage: C:\Windows\System32\lsass.exe
GrantedAccess: 0x1FFFFF
Event 4672: jdoe granted SeDebugPrivilege
SeDebugPrivilege plus full lsass.exe access indicates what?
60s
+3
points
✅ Correct!
Mimikatz (T1003.001): SeDebugPrivilege (Event 4672) is required to access lsass.exe. Access 0x1FFFFF = PROCESS_ALL_ACCESS. Together = Mimikatz or similar tool extracting NTLM hashes. Mitigate: Credential Guard, restrict SeDebugPrivilege via GPO.
MITRE T1003.001