Suspicious LSASS Access From Non System Account (via security)

title: Suspicious LSASS Access From Non System Account (via security)
id: 8d82b1b7-0023-5955-a23f-f41ded7fe6f1
status: stable
description: This rule detects potential mimikatz-like tools accessing LSASS from non system account
references:
    - https://attack.mitre.org/techniques/T1003/001/
    - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html
author: Huntrule Team
date: 2026-04-28
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4663
            - 4656
        AccessMask:
            - '0x100000'
            - '0x1010'
            - '0x1400'
            - '0x1410'
            - '0x1418'
            - '0x1438'
            - '0x143a'
            - '0x1f0fff'
            - '0x1f1fff'
            - '0x1f2fff'
            - '0x1f3fff'
            - '0x40'
            - '143a'
            - '1f0fff'
            - '1f1fff'
            - '1f2fff'
            - '1f3fff'
        ObjectType: 'Process'
        ObjectName|endswith: '\lsass.exe'
    filter_main_service_account:
        SubjectUserName|endswith: '$'
    filter_main_generic:
        ProcessName|contains:
            - ':\Program Files\'
            - ':\Program Files (x86)\'
    filter_main_wmiprvse:
        ProcessName: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
        AccessMask: '0x1410'
    filter_optional_steam:
        ProcessName|contains: '\SteamLibrary\steamapps\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium