Suspicious LSASS handle access from svchost.exe via seclogon.dll (Windows process access)

title: Suspicious LSASS handle access from svchost.exe via seclogon.dll (Windows process access)
id: b1ad0e7c-7195-4444-b4f2-3d8dd80e339c
status: test
description: This rule identifies process access events where svchost.exe attempts to open a handle to lsass.exe with granted access 0x14c0, and the call trace includes seclogon.dll. Attackers may use seclogon to access LSASS memory to obtain credentials, making this behavior high-signal for credential access attempts. The detection relies on Windows process access telemetry including TargetImage, SourceImage, GrantedAccess, and CallTrace.
references:
  - https://twitter.com/SBousseaden/status/1541920424635912196
  - https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml
  - https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml
author: Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-29
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|endswith: \svchost.exe
    GrantedAccess: "0x14c0"
    CallTrace|contains: seclogon.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 472159c5-31b9-4f56-b794-b766faa8b0a7
    type: derived