huntrule

Windows PowerShell remote thread into lsass.exe for potential credential dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

FreeUnreviewedSigmahighv1
title: Windows PowerShell remote thread into lsass.exe for potential credential dumping
id: 742a37dd-70e4-499d-87d7-a146c097a66e
related:
  - id: 3f07b9d1-2082-4c56-9277-613a621983cc
    type: obsolete
  - id: 0f920ebe-7aea-4c54-b202-9aa0c609cfe5
    type: similar
  - id: fb656378-f909-47c1-8747-278bf09f4f4f
    type: derived
status: test
description: This rule flags Windows processes running PowerShell that create a remote thread targeting lsass.exe. Such behavior is commonly used to access process memory where credential material may reside, making it a high-signal indicator of credential-access activity. The detection relies on telemetry for remote thread creation with both the source process name (powershell.exe/pwsh.exe) and the target process name (lsass.exe).
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2022-12-18
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: create_remote_thread
detection:
  selection:
    SourceImage|endswith:
      - \powershell.exe
      - \pwsh.exe
    TargetImage|endswith: \lsass.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows processes running PowerShell that create a remote thread targeting lsass.exe. Such behavior is commonly used to access process memory where credential material may reside, making it a high-signal indicator of credential-access activity. The detection relies on telemetry for remote thread creation with both the source process name (powershell.exe/pwsh.exe) and the target process name (lsass.exe).

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.