Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)
Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.
- Product
- windows
- Service
- windefend
- Author
- Markus Neis (SigmaHQ), DRL 1.1
- Published
- 2018-08-26
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Defender (ASR) events where access to the lsass.exe process is observed, specifically event ID 1121 with a path ending in \lsass.exe. Credential-stealing attempts frequently target LSASS, so correlating these events helps identify attempts that trigger protective controls. It relies on Windows Defender event telemetry from the windefend service and matches the process path reported in the alerting event, excluding several known benign process names and directories.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)
id: ed5379b8-5cda-47dc-8abb-606d0f925511
status: test
description: This rule flags Windows Defender (ASR) events where access to the lsass.exe process is observed, specifically event ID 1121 with a path ending in \lsass.exe. Credential-stealing attempts frequently target LSASS, so correlating these events helps identify attempts that trigger protective controls. It relies on Windows Defender event telemetry from the windefend service and matches the process path reported in the alerting event, excluding several known benign process names and directories.
references:
- https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml
author: Markus Neis, Huntrule Team
date: 2018-08-26
modified: 2022-08-13
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
service: windefend
definition: "Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)"
detection:
selection:
EventID: 1121
Path|endswith: \lsass.exe
filter_thor:
ProcessName|startswith: C:\Windows\Temp\asgard2-agent\
ProcessName|endswith:
- \thor64.exe
- \thor.exe
filter_exact:
ProcessName:
- C:\Windows\System32\atiesrxx.exe
- C:\Windows\System32\CompatTelRunner.exe
- C:\Windows\System32\msiexec.exe
- C:\Windows\System32\nvwmi64.exe
- C:\Windows\System32\svchost.exe
- C:\Windows\System32\Taskmgr.exe
- C:\Windows\System32\wbem\WmiPrvSE.exe
- C:\Windows\SysWOW64\msiexec.exe
filter_begins:
ProcessName|startswith:
- C:\Windows\System32\DriverStore\
- C:\WINDOWS\Installer\
- C:\Program Files\
- C:\Program Files (x86)\
condition: selection and not 1 of filter_*
falsepositives:
- Google Chrome GoogleUpdate.exe
- Some Taskmgr.exe related activity
level: high
license: DRL-1.1
related:
- id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98
type: derived