Windows Process Access to LSASS with Suspicious GrantedAccess Flags

title: Windows Process Access to LSASS with Suspicious GrantedAccess Flags
id: ee8caef2-6083-4639-b181-f69dab93ea0c
related:
  - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
    type: similar
  - id: a18dd26b-6450-46de-8c91-9659150cf088
    type: derived
status: test
description: This rule flags Windows process-access events where a process requests access rights to lsass.exe using GrantedAccess values associated with potentially sensitive operations. Attackers often target LSASS to access credential material, so unusual process access rights to this process are high-signal activity. The detection relies on process access telemetry that records TargetImage (ending with \lsass.exe), GrantedAccess, the caller process (SourceImage), and optional call trace context to reduce expected benign noise.
references:
  - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community, Huntrule Team
date: 2021-11-22
modified: 2026-06-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|endswith: \lsass.exe
  selection_access:
    - GrantedAccess|endswith:
        - "30"
        - "50"
        - "70"
        - "90"
        - B0
        - D0
        - F0
        - "18"
        - "38"
        - "58"
        - "78"
        - "98"
        - B8
        - D8
        - F8
        - 1A
        - 3A
        - 5A
        - 7A
        - 9A
        - BA
        - DA
        - FA
        - "0x14C2"
    - GrantedAccess|startswith:
        - "0x100000"
        - "0x1418"
        - "0x1438"
        - "0x143a"
        - "0x1f0fff"
        - "0x1f1fff"
        - "0x1f2fff"
        - "0x1f3fff"
        - "0x40"
  filter_main_generic:
    SourceImage|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  filter_optional_malwarebytes:
    SourceImage|endswith: :\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe
  filter_optional_vscode:
    SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
  filter_main_windefend_1:
    SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\
    SourceImage|endswith: \MsMpEng.exe
  filter_main_windefend_2:
    CallTrace|contains|all:
      - "|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{"
      - "}\\mpengine.dll+"
    GrantedAccess: "0x1418"
  filter_main_windefend_3:
    CallTrace|contains:
      - "|c:\\program files\\windows defender\\mprtp.dll"
      - "|c:\\program files\\windows defender\\MpClient.dll"
  filter_optional_vmwaretools:
    SourceImage|contains: :\ProgramData\VMware\VMware Tools\
    SourceImage|endswith: \vmtoolsd.exe
  filter_optional_sysinternals_process_explorer:
    SourceImage|endswith:
      - \PROCEXP64.EXE
      - \PROCEXP.EXE
    GrantedAccess: "0x40"
  filter_optional_mbami:
    SourceImage|endswith: \MBAMInstallerService.exe
    GrantedAccess: "0x40"
  filter_optional_nextron:
    SourceImage|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
      - \thor.exe
      - \thor64.exe
    GrantedAccess: "0x40"
  filter_main_explorer:
    SourceImage|endswith: \explorer.exe
    GrantedAccess: "0x401"
  filter_optional_sysinternals_handle:
    SourceImage|endswith:
      - \handle.exe
      - \handle64.exe
      - \handle64a.exe
    GrantedAccess: "0x40"
  filter_optional_webex:
    SourceImage|endswith: \AppData\Local\WebEx\WebexHost.exe
    GrantedAccess: "0x401"
  filter_optional_steam_apps:
    SourceImage|contains: \SteamLibrary\steamapps\
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software such as AV and EDR
level: medium
license: DRL-1.1