Windows process access to LSASS.exe with suspicious GrantedAccess flags

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_access
Author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
Published: 2021-11-22
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process access events targeting lsass.exe where the GrantedAccess value matches a set of potentially sensitive rights. Attackers often request elevated or credential-related access to LSASS to support credential dumping or related post-compromise activity. It relies on Windows process access telemetry (process_access events) including the TargetImage/lsass.exe path and the GrantedAccess value, with exclusions for common benign processes such as antivirus and other tooling.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows process access to LSASS.exe with suspicious GrantedAccess flags

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-access-to-lsass-with-suspicious-grantedaccess-flags-a18dd26b

title: Windows process access to LSASS.exe with suspicious GrantedAccess flags
id: ee8caef2-6083-4639-b181-f69dab93ea0c
related:
  - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
    type: similar
  - id: a18dd26b-6450-46de-8c91-9659150cf088
    type: derived
status: test
description: This rule flags process access events targeting lsass.exe where the GrantedAccess value matches a set of potentially sensitive rights. Attackers often request elevated or credential-related access to LSASS to support credential dumping or related post-compromise activity. It relies on Windows process access telemetry (process_access events) including the TargetImage/lsass.exe path and the GrantedAccess value, with exclusions for common benign processes such as antivirus and other tooling.
references:
  - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community, Huntrule Team
date: 2021-11-22
modified: 2026-06-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|endswith: \lsass.exe
  selection_access:
    - GrantedAccess|endswith:
        - "30"
        - "50"
        - "70"
        - "90"
        - B0
        - D0
        - F0
        - "18"
        - "38"
        - "58"
        - "78"
        - "98"
        - B8
        - D8
        - F8
        - 1A
        - 3A
        - 5A
        - 7A
        - 9A
        - BA
        - DA
        - FA
        - "0x14C2"
    - GrantedAccess|startswith:
        - "0x100000"
        - "0x1418"
        - "0x1438"
        - "0x143a"
        - "0x1f0fff"
        - "0x1f1fff"
        - "0x1f2fff"
        - "0x1f3fff"
        - "0x40"
  filter_main_generic:
    SourceImage|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  filter_optional_malwarebytes:
    SourceImage|endswith: :\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe
  filter_optional_vscode:
    SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
  filter_main_windefend_1:
    SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\
    SourceImage|endswith: \MsMpEng.exe
  filter_main_windefend_2:
    CallTrace|contains|all:
      - "|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{"
      - "}\\mpengine.dll+"
    GrantedAccess: "0x1418"
  filter_main_windefend_3:
    CallTrace|contains:
      - "|c:\\program files\\windows defender\\mprtp.dll"
      - "|c:\\program files\\windows defender\\MpClient.dll"
  filter_optional_vmwaretools:
    SourceImage|contains: :\ProgramData\VMware\VMware Tools\
    SourceImage|endswith: \vmtoolsd.exe
  filter_optional_sysinternals_process_explorer:
    SourceImage|endswith:
      - \PROCEXP64.EXE
      - \PROCEXP.EXE
    GrantedAccess: "0x40"
  filter_optional_mbami:
    SourceImage|endswith: \MBAMInstallerService.exe
    GrantedAccess: "0x40"
  filter_optional_nextron:
    SourceImage|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
      - \thor.exe
      - \thor64.exe
    GrantedAccess: "0x40"
  filter_main_explorer:
    SourceImage|endswith: \explorer.exe
    GrantedAccess: "0x401"
  filter_optional_sysinternals_handle:
    SourceImage|endswith:
      - \handle.exe
      - \handle64.exe
      - \handle64a.exe
    GrantedAccess: "0x40"
  filter_optional_webex:
    SourceImage|endswith: \AppData\Local\WebEx\WebexHost.exe
    GrantedAccess: "0x401"
  filter_optional_steam_apps:
    SourceImage|contains: \SteamLibrary\steamapps\
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software such as AV and EDR
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL