Windows LSASS Memory Access via Process Access Flags From Suspicious Paths

Alerts on processes attempting sensitive access to lsass.exe originating from suspicious/temp directories, using granted access and source path context.

FreeReviewedSigma · Medium · v7

Product: windows
Category: process_access
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-11-27
Updated: 2026-09-15

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process access to LSASS (lsass.exe) when the access rights granted include values commonly associated with credential dumping or memory inspection. It is significant because malware and post-exploitation tools often obtain LSASS memory by opening a handle with specific permissions. The detection relies on process access telemetry that includes the target process path, the granted access mask, and the source process image path containing common suspicious directories.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

Suspicious Physical Memory Acquisition via WinPmem (via process_creation)

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

Suspicious LSASS Credential Access via PowerShell (via process_creation)

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

Suspicious ProcDump LSASS Memory Dump via process_creation

Malicious Mimikatz Credential Dump Log File Creation (via file_event)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Suspicious LSASS Memory Dump via Procdump Process Creation

Windows LSASS Memory Access via Process Access Flags From Suspicious Paths

Pivot detection · T1003.001 · 9 related

Changelog

v7
Candidate ingested via manual entry.2026-09-15
v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-access-to-lsass-from-suspicious-source-folders-fa34b441

title: Windows LSASS Memory Access via Process Access Flags From Suspicious Paths
id: 6b536338-1ae4-41b4-8f65-db7b62d9f0c7
status: test
description: This rule flags process access to LSASS (lsass.exe) when the access rights granted include values commonly associated with credential dumping or memory inspection. It is significant because malware and post-exploitation tools often obtain LSASS memory by opening a handle with specific permissions. The detection relies on process access telemetry that includes the target process path, the granted access mask, and the source process image path containing common suspicious directories.
references:
  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-27
modified: 2026-09-15
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
  - detection.threat-hunting
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess|endswith:
      - "10"
      - "30"
      - "50"
      - "70"
      - "90"
      - B0
      - D0
      - F0
      - "18"
      - "38"
      - "58"
      - "78"
      - "98"
      - B8
      - D8
      - F8
      - 1A
      - 3A
      - 5A
      - 7A
      - 9A
      - BA
      - DA
      - FA
      - "0x14C2"
      - FF
    SourceImage|contains:
      - \Temp\
      - \Users\Public\
      - \PerfLogs\
      - \AppData\
      - \Temporary
  filter_optional_generic_appdata:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\
    SourceImage|endswith:
      - \Microsoft VS Code\Code.exe
      - \software_reporter_tool.exe
      - \DropboxUpdate.exe
      - \MBAMInstallerService.exe
      - \WebexMTA.exe
      - \Meetings\WebexMTAV2.exe
      - \WebEx\WebexHost.exe
      - \JetBrains\Toolbox\bin\jetbrains-toolbox.exe
    GrantedAccess: "0x410"
  filter_optional_dropbox_1:
    SourceImage|contains: :\Windows\Temp\
    SourceImage|endswith: .tmp\DropboxUpdate.exe
    GrantedAccess:
      - "0x410"
      - "0x1410"
  filter_optional_dropbox_2:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\Temp\
    SourceImage|endswith: .tmp\DropboxUpdate.exe
    GrantedAccess: "0x1410"
  filter_optional_dropbox_3:
    SourceImage|contains:
      - :\Program Files (x86)\Dropbox\
      - :\Program Files\Dropbox\
    SourceImage|endswith: \DropboxUpdate.exe
    GrantedAccess: "0x1410"
  filter_optional_nextron:
    SourceImage|contains:
      - :\Windows\Temp\asgard2-agent\
      - :\Windows\Temp\asgard2-agent-sc\
    SourceImage|endswith:
      - \thor64.exe
      - \thor.exe
      - \aurora-agent-64.exe
      - \aurora-agent.exe
    GrantedAccess:
      - "0x1fffff"
      - "0x1010"
      - "0x101010"
  filter_optional_ms_products:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\Temp\
      - \vs_bootstrapper_
    GrantedAccess: "0x1410"
  filter_optional_chrome_update:
    SourceImage|contains: :\Program Files (x86)\Google\Temp\
    SourceImage|endswith: .tmp\GoogleUpdate.exe
    GrantedAccess:
      - "0x410"
      - "0x1410"
  filter_optional_keybase:
    SourceImage|contains: :\Users\
    SourceImage|endswith: \AppData\Local\Keybase\keybase.exe
    GrantedAccess: "0x1fffff"
  filter_optional_avira:
    SourceImage|contains: \AppData\Local\Temp\is-
    SourceImage|endswith: .tmp\avira_system_speedup.tmp
    GrantedAccess: "0x1410"
  filter_optional_viberpc_updater:
    SourceImage|contains: \AppData\Roaming\ViberPC\
    SourceImage|endswith: \updater.exe
    TargetImage|endswith: \winlogon.exe
    GrantedAccess: "0x1fffff"
  filter_optional_adobe_arm_helper:
    SourceImage|contains:
      - :\Program Files\Common Files\Adobe\ARM\
      - :\Program Files (x86)\Common Files\Adobe\ARM\
    SourceImage|endswith: \AdobeARMHelper.exe
    GrantedAccess: "0x1410"
  filter_optional_malwarebytes:
    SourceImage|endswith: \MBAMInstallerService.exe
    GrantedAccess: "0x1410"
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Updaters and installers are typical false positives. Apply custom filters depending on your environment
level: medium
license: DRL-1.1
related:
  - id: fa34b441-961a-42fa-a100-ecc28c886725
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL