huntrule

Windows process access to LSASS.exe with suspicious GrantedAccess flags

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_access
Author
Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community (SigmaHQ), DRL 1.1
Published
2021-11-22
Updated
2026-07-31
AnalysisDetection
title: Windows process access to LSASS.exe with suspicious GrantedAccess flags
id: ee8caef2-6083-4639-b181-f69dab93ea0c
related:
  - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
    type: similar
  - id: a18dd26b-6450-46de-8c91-9659150cf088
    type: derived
status: test
description: This rule flags process access events targeting lsass.exe where the GrantedAccess value matches a set of potentially sensitive rights. Attackers often request elevated or credential-related access to LSASS to support credential dumping or related post-compromise activity. It relies on Windows process access telemetry (process_access events) including the TargetImage/lsass.exe path and the GrantedAccess value, with exclusions for common benign processes such as antivirus and other tooling.
references:
  - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml
author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community, Huntrule Team
date: 2021-11-22
modified: 2026-06-29
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|endswith: \lsass.exe
  selection_access:
    - GrantedAccess|endswith:
        - "30"
        - "50"
        - "70"
        - "90"
        - B0
        - D0
        - F0
        - "18"
        - "38"
        - "58"
        - "78"
        - "98"
        - B8
        - D8
        - F8
        - 1A
        - 3A
        - 5A
        - 7A
        - 9A
        - BA
        - DA
        - FA
        - "0x14C2"
    - GrantedAccess|startswith:
        - "0x100000"
        - "0x1418"
        - "0x1438"
        - "0x143a"
        - "0x1f0fff"
        - "0x1f1fff"
        - "0x1f2fff"
        - "0x1f3fff"
        - "0x40"
  filter_main_generic:
    SourceImage|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  filter_optional_malwarebytes:
    SourceImage|endswith: :\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe
  filter_optional_vscode:
    SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe
  filter_main_windefend_1:
    SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\
    SourceImage|endswith: \MsMpEng.exe
  filter_main_windefend_2:
    CallTrace|contains|all:
      - "|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{"
      - "}\\mpengine.dll+"
    GrantedAccess: "0x1418"
  filter_main_windefend_3:
    CallTrace|contains:
      - "|c:\\program files\\windows defender\\mprtp.dll"
      - "|c:\\program files\\windows defender\\MpClient.dll"
  filter_optional_vmwaretools:
    SourceImage|contains: :\ProgramData\VMware\VMware Tools\
    SourceImage|endswith: \vmtoolsd.exe
  filter_optional_sysinternals_process_explorer:
    SourceImage|endswith:
      - \PROCEXP64.EXE
      - \PROCEXP.EXE
    GrantedAccess: "0x40"
  filter_optional_mbami:
    SourceImage|endswith: \MBAMInstallerService.exe
    GrantedAccess: "0x40"
  filter_optional_nextron:
    SourceImage|endswith:
      - \aurora-agent-64.exe
      - \aurora-agent.exe
      - \thor.exe
      - \thor64.exe
    GrantedAccess: "0x40"
  filter_main_explorer:
    SourceImage|endswith: \explorer.exe
    GrantedAccess: "0x401"
  filter_optional_sysinternals_handle:
    SourceImage|endswith:
      - \handle.exe
      - \handle64.exe
      - \handle64a.exe
    GrantedAccess: "0x40"
  filter_optional_webex:
    SourceImage|endswith: \AppData\Local\WebEx\WebexHost.exe
    GrantedAccess: "0x401"
  filter_optional_steam_apps:
    SourceImage|contains: \SteamLibrary\steamapps\
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software such as AV and EDR
level: medium
license: DRL-1.1