Windows: LSASS memory access from specific process images

title: "Windows: LSASS memory access from specific process images"
id: 51cf3273-5836-42cd-9c8d-0192cc618d68
status: test
description: This rule flags process-access events where a source process ending in TrolleyExpress.exe, ProcessDump.exe, or dump64.exe gains access to lsass.exe. Access rights values are matched to common dump/credential-dumping-related permissions, indicating an attempt to read LSASS memory. Attackers may use benign-looking or allow-listed process names to reduce scrutiny while attempting to extract credentials from LSASS. Telemetry relies on Windows process access logs that record SourceImage, TargetImage, and GrantedAccess.
references:
  - https://twitter.com/_xpn_/status/1491557187168178176
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
  - https://twitter.com/mrd0x/status/1460597833917251595
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-10
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|endswith:
      - \TrolleyExpress.exe
      - \ProcessDump.exe
      - \dump64.exe
    GrantedAccess|endswith:
      - "10"
      - "30"
      - "50"
      - "70"
      - "90"
      - B0
      - D0
      - F0
      - "18"
      - "38"
      - "58"
      - "78"
      - "98"
      - B8
      - D8
      - F8
      - 1A
      - 3A
      - 5A
      - 7A
      - 9A
      - BA
      - DA
      - FA
      - "0x14C2"
      - FF
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4be8b654-0c01-4c9d-a10c-6b28467fc651
    type: derived