20Eyl
Windows Defender’s MsMpEng.exe Access lsass.exe
I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then there is no information about it. Activity's event ID is 4656. Anyone can explain it for me? Why windows defender access lsass.exe. Is it normal or anormal activity?
