In logs, I found lsass.exe spawning lsass.exe.
C:\Windows\System32\smss.exe C:\Windows\System32\smss.exe C:\Windows\System32\wininit.exe C:\Windows\System32\lsass.exe C:\WINDOWS\system32\lsass.exe
lsass.exe should always be a child process of wininit.exe on Windows Vista and later. So, I'm wondering, what can explain such behaviour? Are there legitimate cases where lsass.exe can spawn lsass.exe? I read about process hollowing, but the only examples I could find were services.exe starting lsass.exe.