Windows Security Event Alert: Suspicious AccessMask Requests to LSASS

Flags processes requesting potentially credential-dumping-related access to LSASS based on Security Event 4656/4663.

FreeUnreviewedSigmamediumv1

windows-security-event-alert-suspicious-accessmask-requests-to-lsass-4a1b6da0

title: "Windows Security Event Alert: Suspicious AccessMask Requests to LSASS"
id: 5a0d0944-cc89-45a2-a419-92a587c96a5d
status: test
description: This rule identifies Windows Security auditing events where a process requests a handle to the LSASS process (lsass.exe) with access masks commonly associated with credential-dumping activity. It also cross-references related object access attempts using AccessList values to reduce reliance on a single event type. The detection relies on Security Event IDs 4656 and 4663, specifically matching ObjectName ending in \lsass.exe and filtering out known benign processes and patterns to limit false positives.
references:
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml
author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update), Huntrule Team
date: 2019-11-01
modified: 2026-06-29
tags:
  - attack.credential-access
  - car.2019-04-004
  - attack.t1003.001
logsource:
  product: windows
  service: security
detection:
  selection_1:
    EventID: 4656
    ObjectName|endswith: \lsass.exe
    AccessMask|contains:
      - "0x40"
      - "0x1400"
      - "0x100000"
      - "0x1410"
      - "0x1010"
      - "0x1438"
      - "0x143a"
      - "0x1418"
      - "0x1f0fff"
      - "0x1f1fff"
      - "0x1f2fff"
      - "0x1f3fff"
  selection_2:
    EventID: 4663
    ObjectName|endswith: \lsass.exe
    AccessList|contains:
      - "4484"
      - "4416"
  filter_main_specific:
    ProcessName|endswith:
      - \csrss.exe
      - \GamingServices.exe
      - \lsm.exe
      - \MicrosoftEdgeUpdate.exe
      - \minionhost.exe
      - \MRT.exe
      - \MsMpEng.exe
      - \perfmon.exe
      - \procexp.exe
      - \procexp64.exe
      - \procexp64a.exe
      - \svchost.exe
      - \taskmgr.exe
      - \thor.exe
      - \thor64.exe
      - \vmtoolsd.exe
      - \VsTskMgr.exe
      - \wininit.exe
      - \wmiprvse.exe
      - RtkAudUService64
    ProcessName|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\ProgramData\Microsoft\Windows Defender\Platform\
      - :\Windows\SysNative\
      - :\Windows\System32\
      - :\Windows\SysWow64\
      - :\Windows\Temp\asgard2-agent\
  filter_main_generic:
    ProcessName|contains: :\Program Files
  filter_main_exact:
    ProcessName|endswith:
      - :\Windows\System32\taskhostw.exe
      - :\Windows\System32\msiexec.exe
      - :\Windows\CCM\CcmExec.exe
  filter_main_sysmon:
    ProcessName|endswith:
      - :\Windows\Sysmon64.exe
      - :\Windows\Sysmon64a.exe
    AccessList|contains: "%%4484"
  filter_main_aurora:
    ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\
    ProcessName|endswith: \aurora-agent-64.exe
    AccessList|contains: "%%4484"
  filter_main_scenarioengine:
    ProcessName|endswith: \x64\SCENARIOENGINE.EXE
    AccessList|contains: "%%4484"
  filter_main_avira1:
    ProcessName|contains|all:
      - :\Users\
      - \AppData\Local\Temp\is-
    ProcessName|endswith: \avira_system_speedup.tmp
    AccessList|contains: "%%4484"
  filter_main_avira2:
    ProcessName|contains: :\Windows\Temp\
    ProcessName|endswith: \avira_speedup_setup_update.tmp
    AccessList|contains: "%%4484"
  filter_main_snmp:
    ProcessName|endswith: :\Windows\System32\snmp.exe
    AccessList|contains: "%%4484"
  filter_main_googleupdate:
    ProcessName|contains: :\Windows\SystemTemp\
    ProcessName|endswith: \GoogleUpdate.exe
    AccessList|contains: "%%4484"
  filter_optional_procmon:
    ProcessName|endswith:
      - \procmon64.exe
      - \procmon64a.exe
      - \procmon.exe
    AccessList|contains: "%%4484"
  condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it
level: medium
license: DRL-1.1
related:
  - id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76
    type: derived

What it detects

This rule identifies Windows Security auditing events where a process requests a handle to the LSASS process (lsass.exe) with access masks commonly associated with credential-dumping activity. It also cross-references related object access attempts using AccessList values to reduce reliance on a single event type. The detection relies on Security Event IDs 4656 and 4663, specifically matching ObjectName ending in \lsass.exe and filtering out known benign processes and patterns to limit false positives.

Known false positives

Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.