Windows Defender (ASR) LSASS Access Block Event 1121 Detection

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.

FreeUnreviewedSigmahighv1

windows-defender-asr-lsass-access-block-event-1121-detection-a0a278fe

title: Windows Defender (ASR) LSASS Access Block Event 1121 Detection
id: ed5379b8-5cda-47dc-8abb-606d0f925511
status: test
description: This rule flags Windows Defender ASR events indicating blocked access to the lsass.exe process (EventID 1121) when the target path ends with \lsass.exe. Attackers often attempt to read credential material from LSASS, so unexpected or repeated access attempts matter even when blocked. The detection relies on windefend telemetry with EventID 1121 and process path information, and it excludes several known benign process paths to reduce noise.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml
author: Markus Neis, Huntrule Team
date: 2018-08-26
modified: 2022-08-13
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: windefend
  definition: "Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)"
detection:
  selection:
    EventID: 1121
    Path|endswith: \lsass.exe
  filter_thor:
    ProcessName|startswith: C:\Windows\Temp\asgard2-agent\
    ProcessName|endswith:
      - \thor64.exe
      - \thor.exe
  filter_exact:
    ProcessName:
      - C:\Windows\System32\atiesrxx.exe
      - C:\Windows\System32\CompatTelRunner.exe
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\System32\nvwmi64.exe
      - C:\Windows\System32\svchost.exe
      - C:\Windows\System32\Taskmgr.exe
      - C:\Windows\System32\wbem\WmiPrvSE.exe
      - C:\Windows\SysWOW64\msiexec.exe
  filter_begins:
    ProcessName|startswith:
      - C:\Windows\System32\DriverStore\
      - C:\WINDOWS\Installer\
      - C:\Program Files\
      - C:\Program Files (x86)\
  condition: selection and not 1 of filter_*
falsepositives:
  - Google Chrome GoogleUpdate.exe
  - Some Taskmgr.exe related activity
level: high
license: DRL-1.1
related:
  - id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98
    type: derived

What it detects

This rule flags Windows Defender ASR events indicating blocked access to the lsass.exe process (EventID 1121) when the target path ends with \lsass.exe. Attackers often attempt to read credential material from LSASS, so unexpected or repeated access attempts matter even when blocked. The detection relies on windefend telemetry with EventID 1121 and process path information, and it excludes several known benign process paths to reduce noise.

Known false positives

Google Chrome GoogleUpdate.exe
Some Taskmgr.exe related activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.