Windows LSASS Process Clone Execution Observed

title: Windows LSASS Process Clone Execution Observed
id: f99fd7a9-be4c-417b-b502-013980505d42
status: test
description: This rule flags process creation events where both the parent process image and the new process image are lsass.exe from System32, indicating an LSASS process clone. Such cloning can be used to access or manipulate credential material and is a known tactic to support credential dumping workflows. The detection relies on Windows process creation telemetry that includes the parent process image and the process image path ending in \Windows\System32\lsass.exe.
references:
  - https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/
  - https://twitter.com/Hexacorn/status/1420053502554951689
  - https://twitter.com/SBousseaden/status/1464566846594691073?s=20
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml
author: Florian Roth (Nextron Systems), Samir Bousseaden, Huntrule Team
date: 2021-11-27
modified: 2023-03-02
tags:
  - attack.credential-access
  - attack.t1003
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \Windows\System32\lsass.exe
    Image|endswith: \Windows\System32\lsass.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: c8da0dfd-4ed0-4b68-962d-13c9c884384e
    type: derived