Windows Process Access to LSASS Memory From Suspicious Source Paths

Alerts on processes attempting sensitive access to lsass.exe originating from suspicious/temp directories, using granted access and source path context.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_access
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-11-27
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows processes accessing LSASS (lsass.exe) memory with specific granted-access values while originating from paths commonly associated with staging and user-writable locations (for example, Temp and AppData). Such access is important because credential-dumping and related attacks often require reading LSASS memory or obtaining high-privilege process handles. The detection relies on process access telemetry indicating the target image (lsass.exe), the source image path, and the granted access rights.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows Process Access to LSASS Memory From Suspicious Source Paths

Pivot detection · T1003.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-access-to-lsass-from-suspicious-source-folders-fa34b441

title: Windows Process Access to LSASS Memory From Suspicious Source Paths
id: 6b536338-1ae4-41b4-8f65-db7b62d9f0c7
status: test
description: This rule flags Windows processes accessing LSASS (lsass.exe) memory with specific granted-access values while originating from paths commonly associated with staging and user-writable locations (for example, Temp and AppData). Such access is important because credential-dumping and related attacks often require reading LSASS memory or obtaining high-privilege process handles. The detection relies on process access telemetry indicating the target image (lsass.exe), the source image path, and the granted access rights.
references:
  - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-27
modified: 2023-12-06
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
  - detection.threat-hunting
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess|endswith:
      - "10"
      - "30"
      - "50"
      - "70"
      - "90"
      - B0
      - D0
      - F0
      - "18"
      - "38"
      - "58"
      - "78"
      - "98"
      - B8
      - D8
      - F8
      - 1A
      - 3A
      - 5A
      - 7A
      - 9A
      - BA
      - DA
      - FA
      - "0x14C2"
      - FF
    SourceImage|contains:
      - \Temp\
      - \Users\Public\
      - \PerfLogs\
      - \AppData\
      - \Temporary
  filter_optional_generic_appdata:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\
    SourceImage|endswith:
      - \Microsoft VS Code\Code.exe
      - \software_reporter_tool.exe
      - \DropboxUpdate.exe
      - \MBAMInstallerService.exe
      - \WebexMTA.exe
      - \Meetings\WebexMTAV2.exe
      - \WebEx\WebexHost.exe
      - \JetBrains\Toolbox\bin\jetbrains-toolbox.exe
    GrantedAccess: "0x410"
  filter_optional_dropbox_1:
    SourceImage|contains: :\Windows\Temp\
    SourceImage|endswith: .tmp\DropboxUpdate.exe
    GrantedAccess:
      - "0x410"
      - "0x1410"
  filter_optional_dropbox_2:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\Temp\
    SourceImage|endswith: .tmp\DropboxUpdate.exe
    GrantedAccess: "0x1410"
  filter_optional_dropbox_3:
    SourceImage|contains:
      - :\Program Files (x86)\Dropbox\
      - :\Program Files\Dropbox\
    SourceImage|endswith: \DropboxUpdate.exe
    GrantedAccess: "0x1410"
  filter_optional_nextron:
    SourceImage|contains:
      - :\Windows\Temp\asgard2-agent\
      - :\Windows\Temp\asgard2-agent-sc\
    SourceImage|endswith:
      - \thor64.exe
      - \thor.exe
      - \aurora-agent-64.exe
      - \aurora-agent.exe
    GrantedAccess:
      - "0x1fffff"
      - "0x1010"
      - "0x101010"
  filter_optional_ms_products:
    SourceImage|contains|all:
      - :\Users\
      - \AppData\Local\Temp\
      - \vs_bootstrapper_
    GrantedAccess: "0x1410"
  filter_optional_chrome_update:
    SourceImage|contains: :\Program Files (x86)\Google\Temp\
    SourceImage|endswith: .tmp\GoogleUpdate.exe
    GrantedAccess:
      - "0x410"
      - "0x1410"
  filter_optional_keybase:
    SourceImage|contains: :\Users\
    SourceImage|endswith: \AppData\Local\Keybase\keybase.exe
    GrantedAccess: "0x1fffff"
  filter_optional_avira:
    SourceImage|contains: \AppData\Local\Temp\is-
    SourceImage|endswith: .tmp\avira_system_speedup.tmp
    GrantedAccess: "0x1410"
  filter_optional_viberpc_updater:
    SourceImage|contains: \AppData\Roaming\ViberPC\
    SourceImage|endswith: \updater.exe
    TargetImage|endswith: \winlogon.exe
    GrantedAccess: "0x1fffff"
  filter_optional_adobe_arm_helper:
    SourceImage|contains:
      - :\Program Files\Common Files\Adobe\ARM\
      - :\Program Files (x86)\Common Files\Adobe\ARM\
    SourceImage|endswith: \AdobeARMHelper.exe
    GrantedAccess: "0x1410"
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Updaters and installers are typical false positives. Apply custom filters depending on your environment
level: medium
license: DRL-1.1
related:
  - id: fa34b441-961a-42fa-a100-ecc28c886725
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL