Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.

FreeReviewedSigma · High · v2

Product: windows
Service: windefend
Author: Markus Neis (SigmaHQ), DRL 1.1
Published: 2018-08-26
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Defender (ASR) events where access to the lsass.exe process is observed, specifically event ID 1121 with a path ending in \lsass.exe. Credential-stealing attempts frequently target LSASS, so correlating these events helps identify attempts that trigger protective controls. It relies on Windows Defender event telemetry from the windefend service and matches the process path reported in the alerting event, excluding several known benign process names and directories.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious Mimikatz Credential Dumping via Command Line Arguments

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

Suspicious Physical Memory Acquisition via WinPmem (via process_creation)

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

Suspicious LSASS Credential Access via PowerShell (via process_creation)

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

Suspicious ProcDump LSASS Memory Dump via process_creation

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-defender-asr-lsass-access-block-event-1121-detection-a0a278fe

title: Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)
id: ed5379b8-5cda-47dc-8abb-606d0f925511
status: test
description: This rule flags Windows Defender (ASR) events where access to the lsass.exe process is observed, specifically event ID 1121 with a path ending in \lsass.exe. Credential-stealing attempts frequently target LSASS, so correlating these events helps identify attempts that trigger protective controls. It relies on Windows Defender event telemetry from the windefend service and matches the process path reported in the alerting event, excluding several known benign process names and directories.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml
author: Markus Neis, Huntrule Team
date: 2018-08-26
modified: 2022-08-13
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: windefend
  definition: "Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)"
detection:
  selection:
    EventID: 1121
    Path|endswith: \lsass.exe
  filter_thor:
    ProcessName|startswith: C:\Windows\Temp\asgard2-agent\
    ProcessName|endswith:
      - \thor64.exe
      - \thor.exe
  filter_exact:
    ProcessName:
      - C:\Windows\System32\atiesrxx.exe
      - C:\Windows\System32\CompatTelRunner.exe
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\System32\nvwmi64.exe
      - C:\Windows\System32\svchost.exe
      - C:\Windows\System32\Taskmgr.exe
      - C:\Windows\System32\wbem\WmiPrvSE.exe
      - C:\Windows\SysWOW64\msiexec.exe
  filter_begins:
    ProcessName|startswith:
      - C:\Windows\System32\DriverStore\
      - C:\WINDOWS\Installer\
      - C:\Program Files\
      - C:\Program Files (x86)\
  condition: selection and not 1 of filter_*
falsepositives:
  - Google Chrome GoogleUpdate.exe
  - Some Taskmgr.exe related activity
level: high
license: DRL-1.1
related:
  - id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL