Windows Process Access with High GrantedAccess to WMI Provider and LSASS

Alerts on high-privilege process access from wmiprvse.exe to lsass.exe consistent with potential shellcode injection behavior.

FreeUnreviewedSigmamediumv1

windows-process-access-with-high-grantedaccess-to-wmi-provider-and-lsass-250ae82f

title: Windows Process Access with High GrantedAccess to WMI Provider and LSASS
id: f07d0001-9fd8-410d-9419-a5f0b9788428
status: test
description: This rule flags process access events that indicate potential shellcode injection attempts, based on specific GrantedAccess values and an anomalous call trace marker. It focuses on access targeting lsass.exe by the WMI provider wmiprvse.exe, which is a common prerequisite for credential-stealing or stealthy payload execution. The detection relies on Windows process access telemetry including GrantedAccess, SourceImage, TargetImage, and CallTrace contents, while excluding several known benign Dell and Visual Studio-related image pairs.
references:
  - https://github.com/EmpireProject/PSInject
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_access/proc_access_win_susp_potential_shellcode_injection.yml
author: Bhabesh Raj, Huntrule Team
date: 2022-03-11
modified: 2024-07-02
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.threat-hunting
logsource:
  category: process_access
  product: windows
detection:
  selection:
    GrantedAccess:
      - "0x147a"
      - "0x1f3fff"
    CallTrace|contains: UNKNOWN
  filter_main_wmiprvse:
    SourceImage: C:\Windows\System32\Wbem\Wmiprvse.exe
    TargetImage: C:\Windows\system32\lsass.exe
  filter_optional_dell_folders:
    SourceImage|startswith:
      - C:\Program Files\Dell\
      - C:\Program Files (x86)\Dell\
    TargetImage|startswith:
      - C:\Program Files\Dell\
      - C:\Program Files (x86)\Dell\
  filter_optional_dell_specifc:
    SourceImage: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe
    TargetImage: C:\Windows\Explorer.EXE
  filter_optional_visual_studio:
    SourceImage|startswith: C:\Program Files\Microsoft Visual Studio\
    TargetImage|startswith: C:\Program Files\Microsoft Visual Studio\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 250ae82f-736e-4844-a68b-0b5e8cc887da
    type: derived

What it detects

This rule flags process access events that indicate potential shellcode injection attempts, based on specific GrantedAccess values and an anomalous call trace marker. It focuses on access targeting lsass.exe by the WMI provider wmiprvse.exe, which is a common prerequisite for credential-stealing or stealthy payload execution. The detection relies on Windows process access telemetry including GrantedAccess, SourceImage, TargetImage, and CallTrace contents, while excluding several known benign Dell and Visual Studio-related image pairs.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.