Hi, I’m Mehmet Kadir CIRIK

Senior Cyber Security Engineer

title: LSASS Memory Access
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess: '0x1010'
  condition: selection
level: high

SOC Prime · Detection rule author

Photos

--:-- TRTKeçiörenAnkaraÇankaya

Barikat Cyber SecuritySenior Cyber Security Engineer

5+ years of experience

5 companies · SOC, MDR, DFIR

HuntRule

An open library of 6,500+ expert-reviewed Sigma detection rules sourced from real threat reporting, with telemetry requirements and coverage gaps.

19 certifications

SOC Prime, Splunk, Kaspersky, CrowdStrike…

Latest writingSeptember 23, 2026 · 11 min read

MCP and SIEM Integration: Log Poisoning and Indirect Prompt Injection (Part 2)

The second part of the series looks at the risk that comes from the source of the data entering the SIEM. It covers how an attacker can steer a language model with nothing but a log line, which patterns actually work and a detection rule.

All posts All projects

Focus

EDRNDRXDRSIEMSOARDLPThreat HuntingIncident ResponseDetection EngineeringDFIRDevSecOpsVulnerability MgmtBlue Team