huntrule

Windows PowerShell Process Accessing lsass.exe for Possible Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

FreeUnreviewedSigmamediumv1
title: Windows PowerShell Process Accessing lsass.exe for Possible Credential Dumping
id: 5427af29-375e-4548-835f-56ee520f2573
related:
  - id: 3f07b9d1-2082-4c56-9277-613a621983cc
    type: obsolete
  - id: fb656378-f909-47c1-8747-278bf09f4f4f
    type: similar
  - id: 0f920ebe-7aea-4c54-b202-9aa0c609cfe5
    type: derived
status: test
description: This rule flags PowerShell execution where the source process accesses a target process ending with lsass.exe. Access to LSASS is a common prerequisite for credential dumping, so correlating PowerShell with lsass.exe process access helps identify potential credential-access activity. It relies on Windows process access telemetry that records source image paths and the accessed target image.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_access/proc_access_win_lsass_powershell_access.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2023-11-28
tags:
  - attack.credential-access
  - attack.t1003.001
  - detection.threat-hunting
logsource:
  product: windows
  category: process_access
detection:
  selection:
    SourceImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetImage|endswith: \lsass.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell execution where the source process accesses a target process ending with lsass.exe. Access to LSASS is a common prerequisite for credential dumping, so correlating PowerShell with lsass.exe process access helps identify potential credential-access activity. It relies on Windows process access telemetry that records source image paths and the accessed target image.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.