huntrule

Windows LSASS Process Access by Python-Based Tool

Alerts on process-access attempts to lsass.exe with a Python-related call trace and high granted access.

FreeUnreviewedSigmahighv1
title: Windows LSASS Process Access by Python-Based Tool
id: 47d2ed17-1d38-4b69-843b-fbf6cae4785c
related:
  - id: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0
    type: obsolete
  - id: 7186e989-4ed7-4f4e-a656-4674b9e3e48b
    type: obsolete
  - id: f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9
    type: derived
status: stable
description: This rule flags Windows process access targeting lsass.exe where the call stack indicates a Python runtime interaction and access rights consistent with credential dumping attempts. Attackers often need access to LSASS memory to extract credentials, and Python-based tooling can drive this access through ctypes-style native calls. It relies on process access telemetry that includes the target image, granted access, and call trace DLL patterns.
references:
  - https://twitter.com/bh4b3sh/status/1303674603819081728
  - https://github.com/skelsec/pypykatz
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml
author: Bhabesh Raj, Jonhnathan Ribeiro, Huntrule Team
date: 2023-11-27
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0349
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    CallTrace|contains|all:
      - _ctypes.pyd+
      - :\Windows\System32\KERNELBASE.dll+
      - :\Windows\SYSTEM32\ntdll.dll+
    CallTrace|contains:
      - python27.dll+
      - python3*.dll+
    GrantedAccess: "0x1FFFFF"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows process access targeting lsass.exe where the call stack indicates a Python runtime interaction and access rights consistent with credential dumping attempts. Attackers often need access to LSASS memory to extract credentials, and Python-based tooling can drive this access through ctypes-style native calls. It relies on process access telemetry that includes the target image, granted access, and call trace DLL patterns.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.