Windows process access to LSASS.exe with suspicious GrantedAccess flags
Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_access
- Author
- Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2021-11-22
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process access events targeting lsass.exe where the GrantedAccess value matches a set of potentially sensitive rights. Attackers often request elevated or credential-related access to LSASS to support credential dumping or related post-compromise activity. It relies on Windows process access telemetry (process_access events) including the TargetImage/lsass.exe path and the GrantedAccess value, with exclusions for common benign processes such as antivirus and other tooling.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
- onedrive.live.comhttps://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
- web.archive.orghttps://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- web.archive.orghttps://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-access-to-lsass-with-suspicious-grantedaccess-flags-a18dd26b
title: Windows process access to LSASS.exe with suspicious GrantedAccess flags
id: ee8caef2-6083-4639-b181-f69dab93ea0c
related:
- id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
type: similar
- id: a18dd26b-6450-46de-8c91-9659150cf088
type: derived
status: test
description: This rule flags process access events targeting lsass.exe where the GrantedAccess value matches a set of potentially sensitive rights. Attackers often request elevated or credential-related access to LSASS to support credential dumping or related post-compromise activity. It relies on Windows process access telemetry (process_access events) including the TargetImage/lsass.exe path and the GrantedAccess value, with exclusions for common benign processes such as antivirus and other tooling.
references:
- https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
- https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
- https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community, Huntrule Team
date: 2021-11-22
modified: 2026-06-29
tags:
- attack.credential-access
- attack.t1003.001
- attack.s0002
logsource:
category: process_access
product: windows
detection:
selection_target:
TargetImage|endswith: \lsass.exe
selection_access:
- GrantedAccess|endswith:
- "30"
- "50"
- "70"
- "90"
- B0
- D0
- F0
- "18"
- "38"
- "58"
- "78"
- "98"
- B8
- D8
- F8
- 1A
- 3A
- 5A
- 7A
- 9A
- BA
- DA
- FA
- "0x14C2"
- GrantedAccess|startswith:
- "0x100000"
- "0x1418"
- "0x1438"
- "0x143a"
- "0x1f0fff"
- "0x1f1fff"
- "0x1f2fff"
- "0x1f3fff"
- "0x40"
filter_main_generic:
SourceImage|contains:
- :\Program Files (x86)\
- :\Program Files\
- :\Windows\System32\
- :\Windows\SysWOW64\
filter_optional_malwarebytes:
SourceImage|endswith: :\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe
filter_optional_vscode:
SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
filter_main_windefend_1:
SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\
SourceImage|endswith: \MsMpEng.exe
filter_main_windefend_2:
CallTrace|contains|all:
- "|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{"
- "}\\mpengine.dll+"
GrantedAccess: "0x1418"
filter_main_windefend_3:
CallTrace|contains:
- "|c:\\program files\\windows defender\\mprtp.dll"
- "|c:\\program files\\windows defender\\MpClient.dll"
filter_optional_vmwaretools:
SourceImage|contains: :\ProgramData\VMware\VMware Tools\
SourceImage|endswith: \vmtoolsd.exe
filter_optional_sysinternals_process_explorer:
SourceImage|endswith:
- \PROCEXP64.EXE
- \PROCEXP.EXE
GrantedAccess: "0x40"
filter_optional_mbami:
SourceImage|endswith: \MBAMInstallerService.exe
GrantedAccess: "0x40"
filter_optional_nextron:
SourceImage|endswith:
- \aurora-agent-64.exe
- \aurora-agent.exe
- \thor.exe
- \thor64.exe
GrantedAccess: "0x40"
filter_main_explorer:
SourceImage|endswith: \explorer.exe
GrantedAccess: "0x401"
filter_optional_sysinternals_handle:
SourceImage|endswith:
- \handle.exe
- \handle64.exe
- \handle64a.exe
GrantedAccess: "0x40"
filter_optional_webex:
SourceImage|endswith: \AppData\Local\WebEx\WebexHost.exe
GrantedAccess: "0x401"
filter_optional_steam_apps:
SourceImage|contains: \SteamLibrary\steamapps\
condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software such as AV and EDR
level: medium
license: DRL-1.1