Hello RSA community,We are looking for a way to better key in on LSASS
Hash harvesting in packet capture. Currently we are keying off of the
event directory being system32\ however we are looking for other
relevant meta for a custom ESA alert. I woul...