huntrule

Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)

Alerts on windefend EventID 1121 for blocked access to lsass.exe, excluding common benign process callers.

FreeReviewedSigma · High · v2
Product
windows
Service
windefend
Author
Markus Neis (SigmaHQ), DRL 1.1
Published
2018-08-26
Updated
2026-07-31
AnalysisDetection
title: Windows LSASS process access blocked by Attack Surface Reduction (Windows Defender event 1121)
id: ed5379b8-5cda-47dc-8abb-606d0f925511
status: test
description: This rule flags Windows Defender (ASR) events where access to the lsass.exe process is observed, specifically event ID 1121 with a path ending in \lsass.exe. Credential-stealing attempts frequently target LSASS, so correlating these events helps identify attempts that trigger protective controls. It relies on Windows Defender event telemetry from the windefend service and matches the process path reported in the alerting event, excluding several known benign process names and directories.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml
author: Markus Neis, Huntrule Team
date: 2018-08-26
modified: 2022-08-13
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: windefend
  definition: "Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)"
detection:
  selection:
    EventID: 1121
    Path|endswith: \lsass.exe
  filter_thor:
    ProcessName|startswith: C:\Windows\Temp\asgard2-agent\
    ProcessName|endswith:
      - \thor64.exe
      - \thor.exe
  filter_exact:
    ProcessName:
      - C:\Windows\System32\atiesrxx.exe
      - C:\Windows\System32\CompatTelRunner.exe
      - C:\Windows\System32\msiexec.exe
      - C:\Windows\System32\nvwmi64.exe
      - C:\Windows\System32\svchost.exe
      - C:\Windows\System32\Taskmgr.exe
      - C:\Windows\System32\wbem\WmiPrvSE.exe
      - C:\Windows\SysWOW64\msiexec.exe
  filter_begins:
    ProcessName|startswith:
      - C:\Windows\System32\DriverStore\
      - C:\WINDOWS\Installer\
      - C:\Program Files\
      - C:\Program Files (x86)\
  condition: selection and not 1 of filter_*
falsepositives:
  - Google Chrome GoogleUpdate.exe
  - Some Taskmgr.exe related activity
level: high
license: DRL-1.1
related:
  - id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98
    type: derived