Windows Process Access to LSASS from Suspicious Source Folders

Alerts on processes attempting sensitive access to lsass.exe originating from suspicious/temp directories, using granted access and source path context.

FreeUnreviewedSigmamediumv1

windows-process-access-to-lsass-from-suspicious-source-folders-fa34b441

title: Windows Process Access to LSASS from Suspicious Source Folders
id: 6b536338-1ae4-41b4-8f65-db7b62d9f0c7
status: test
description: This rule flags Windows process access events targeting lsass.exe where the granted access indicates sensitive memory handling and the accessing process originates from commonly abused or temporary directories. Attackers often need to read credentials or process memory from LSASS, so access from atypical locations is a strong behavioral indicator. The detection relies on process access telemetry that includes the target image, source image path, and granted access value.
references:
  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-27
modified: 2023-12-06
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
  - detection.threat-hunting
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess|endswith:
      - "10"
      - "30"
      - "50"
      - "70"
      - "90"
      - B0
      - D0
      - F0
      - "18"
      - "38"
      - "58"
      - "78"
      - "98"
      - B8
      - D8
      - F8
      - 1A
      - 3A
      - 5A
      - 7A
      - 9A
      - BA
      - DA
      - FA
      - "0x14C2"
      - FF
    SourceImage|contains:
      - \Temp\
      - \Users\Public\
      - \PerfLogs\
      - \AppData\
      - \Temporary
  filter_optional_generic_appdata:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\
    SourceImage|endswith:
      - \Microsoft VS Code\Code.exe
      - \software_reporter_tool.exe
      - \DropboxUpdate.exe
      - \MBAMInstallerService.exe
      - \WebexMTA.exe
      - \Meetings\WebexMTAV2.exe
      - \WebEx\WebexHost.exe
      - \JetBrains\Toolbox\bin\jetbrains-toolbox.exe
    GrantedAccess: "0x410"
  filter_optional_dropbox_1:
    SourceImage|contains: :\Windows\Temp\
    SourceImage|endswith: .tmp\DropboxUpdate.exe
    GrantedAccess:
      - "0x410"
      - "0x1410"
  filter_optional_dropbox_2:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\Temp\
    SourceImage|endswith: .tmp\DropboxUpdate.exe
    GrantedAccess: "0x1410"
  filter_optional_dropbox_3:
    SourceImage|contains:
      - :\Program Files (x86)\Dropbox\
      - :\Program Files\Dropbox\
    SourceImage|endswith: \DropboxUpdate.exe
    GrantedAccess: "0x1410"
  filter_optional_nextron:
    SourceImage|contains:
      - :\Windows\Temp\asgard2-agent\
      - :\Windows\Temp\asgard2-agent-sc\
    SourceImage|endswith:
      - \thor64.exe
      - \thor.exe
      - \aurora-agent-64.exe
      - \aurora-agent.exe
    GrantedAccess:
      - "0x1fffff"
      - "0x1010"
      - "0x101010"
  filter_optional_ms_products:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\Temp\
      - \vs_bootstrapper_
    GrantedAccess: "0x1410"
  filter_optional_chrome_update:
    SourceImage|contains: :\Program Files (x86)\Google\Temp\
    SourceImage|endswith: .tmp\GoogleUpdate.exe
    GrantedAccess:
      - "0x410"
      - "0x1410"
  filter_optional_keybase:
    SourceImage|contains: :\Users\
    SourceImage|endswith: \AppData\Local\Keybase\keybase.exe
    GrantedAccess: "0x1fffff"
  filter_optional_avira:
    SourceImage|contains: \AppData\Local\Temp\is-
    SourceImage|endswith: .tmp\avira_system_speedup.tmp
    GrantedAccess: "0x1410"
  filter_optional_viberpc_updater:
    SourceImage|contains: \AppData\Roaming\ViberPC\
    SourceImage|endswith: \updater.exe
    TargetImage|endswith: \winlogon.exe
    GrantedAccess: "0x1fffff"
  filter_optional_adobe_arm_helper:
    SourceImage|contains:
      - :\Program Files\Common Files\Adobe\ARM\
      - :\Program Files (x86)\Common Files\Adobe\ARM\
    SourceImage|endswith: \AdobeARMHelper.exe
    GrantedAccess: "0x1410"
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Updaters and installers are typical false positives. Apply custom filters depending on your environment
level: medium
license: DRL-1.1
related:
  - id: fa34b441-961a-42fa-a100-ecc28c886725
    type: derived

What it detects

This rule flags Windows process access events targeting lsass.exe where the granted access indicates sensitive memory handling and the accessing process originates from commonly abused or temporary directories. Attackers often need to read credentials or process memory from LSASS, so access from atypical locations is a strong behavioral indicator. The detection relies on process access telemetry that includes the target image, source image path, and granted access value.

Known false positives

Updaters and installers are typical false positives. Apply custom filters depending on your environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.