Windows HandleKatz Usage: Duplicate LSASS Handle via PROCESS_DUP_HANDLE

title: "Windows HandleKatz Usage: Duplicate LSASS Handle via PROCESS_DUP_HANDLE"
id: d0b2e76a-62fe-4978-970b-406d42ffc2a9
status: test
description: This rule matches a process access event where access rights are limited to handle duplication and related query permissions on lsass.exe, along with a call stack pattern consistent with ntdll.dll activity. Duplicating an existing LSASS handle can enable later memory dumping while avoiding opening additional direct handles to LSASS. It relies on Windows process access telemetry, including TargetImage, GrantedAccess, and call trace strings from the access operation.
references:
  - https://github.com/codewhitesec/HandleKatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml
author: Bhabesh Raj (rule), @thefLinkk, Huntrule Team
date: 2022-06-27
modified: 2023-11-28
tags:
  - attack.execution
  - attack.t1106
  - attack.t1003.001
  - attack.credential-access
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess: "0x1440"
    CallTrace|startswith: C:\Windows\System32\ntdll.dll+
    CallTrace|contains: "|UNKNOWN("
    CallTrace|endswith: )
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
    type: derived