Windows Security: Suspicious AccessMask on LSASS Handle Requests (4656/4663)
Flags processes requesting potentially credential-dumping-related access to LSASS based on Security Event 4656/4663.
FreeReviewedSigma · Medium · v4
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) (SigmaHQ), DRL 1.1
- Published
- 2019-11-01
- Updated
- 2026-10-20
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows security events where a process requests a handle to the LSASS process (lsass.exe) with specific, high-value AccessMask/AccessList values. Attackers commonly need elevated access to LSASS to obtain credential material, so handle requests to lsass.exe are a useful signal for credential-access activity. The detection relies on Windows Security auditing events 4656 and 4663/4663-family telemetry that includes ObjectName/ObjectName suffix and access right fields, with exclusions to reduce common benign tooling noise.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-10-20
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-security-event-alert-suspicious-accessmask-requests-to-lsass-4a1b6da0
title: "Windows Security: Suspicious AccessMask on LSASS Handle Requests (4656/4663)"
id: 5a0d0944-cc89-45a2-a419-92a587c96a5d
status: test
description: This rule identifies Windows security events where a process requests a handle to the LSASS process (lsass.exe) with specific, high-value AccessMask/AccessList values. Attackers commonly need elevated access to LSASS to obtain credential material, so handle requests to lsass.exe are a useful signal for credential-access activity. The detection relies on Windows Security auditing events 4656 and 4663/4663-family telemetry that includes ObjectName/ObjectName suffix and access right fields, with exclusions to reduce common benign tooling noise.
references:
- https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml
author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update), Huntrule Team
date: 2019-11-01
modified: 2026-10-20
tags:
- attack.credential-access
- car.2019-04-004
- attack.t1003.001
logsource:
product: windows
service: security
detection:
selection_1:
EventID: 4656
ObjectName|endswith: \lsass.exe
AccessMask|contains:
- "0x40"
- "0x1400"
- "0x1410"
- "0x1010"
- "0x1438"
- "0x143a"
- "0x1418"
- "0x1f0fff"
- "0x1f1fff"
- "0x1f2fff"
- "0x1f3fff"
selection_2:
EventID: 4663
ObjectName|endswith: \lsass.exe
AccessList|contains:
- "4484"
- "4416"
filter_main_specific:
ProcessName|endswith:
- \csrss.exe
- \GamingServices.exe
- \lsm.exe
- \MicrosoftEdgeUpdate.exe
- \minionhost.exe
- \MRT.exe
- \MsMpEng.exe
- \perfmon.exe
- \procexp.exe
- \procexp64.exe
- \procexp64a.exe
- \svchost.exe
- \taskmgr.exe
- \thor.exe
- \thor64.exe
- \vmtoolsd.exe
- \VsTskMgr.exe
- \wininit.exe
- \wmiprvse.exe
- RtkAudUService64
ProcessName|contains:
- :\Program Files (x86)\
- :\Program Files\
- :\ProgramData\Microsoft\Windows Defender\Platform\
- :\Windows\SysNative\
- :\Windows\System32\
- :\Windows\SysWow64\
- :\Windows\Temp\asgard2-agent\
filter_main_generic:
ProcessName|contains: :\Program Files
filter_main_exact:
ProcessName|endswith:
- :\Windows\System32\taskhostw.exe
- :\Windows\System32\msiexec.exe
- :\Windows\CCM\CcmExec.exe
filter_main_sysmon:
ProcessName|endswith:
- :\Windows\Sysmon64.exe
- :\Windows\Sysmon64a.exe
AccessList|contains: "%%4484"
filter_main_aurora:
ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\
ProcessName|endswith: \aurora-agent-64.exe
AccessList|contains: "%%4484"
filter_main_scenarioengine:
ProcessName|endswith: \x64\SCENARIOENGINE.EXE
AccessList|contains: "%%4484"
filter_main_avira1:
ProcessName|contains|all:
- :\Users\
- \AppData\Local\Temp\is-
ProcessName|endswith: \avira_system_speedup.tmp
AccessList|contains: "%%4484"
filter_main_avira2:
ProcessName|contains: :\Windows\Temp\
ProcessName|endswith: \avira_speedup_setup_update.tmp
AccessList|contains: "%%4484"
filter_main_snmp:
ProcessName|endswith: :\Windows\System32\snmp.exe
AccessList|contains: "%%4484"
filter_main_googleupdate:
ProcessName|contains: :\Windows\SystemTemp\
ProcessName|endswith: \GoogleUpdate.exe
AccessList|contains: "%%4484"
filter_optional_procmon:
ProcessName|endswith:
- \procmon64.exe
- \procmon64a.exe
- \procmon.exe
AccessList|contains: "%%4484"
condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it
level: medium
license: DRL-1.1
related:
- id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76
type: derived