huntrule

Windows Security: Suspicious AccessMask on LSASS Handle Requests (4656/4663)

Flags processes requesting potentially credential-dumping-related access to LSASS based on Security Event 4656/4663.

FreeReviewedSigma · Medium · v4
Product
windows
Service
security
Author
Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) (SigmaHQ), DRL 1.1
Published
2019-11-01
Updated
2026-10-20
AnalysisDetection
title: "Windows Security: Suspicious AccessMask on LSASS Handle Requests (4656/4663)"
id: 5a0d0944-cc89-45a2-a419-92a587c96a5d
status: test
description: This rule identifies Windows security events where a process requests a handle to the LSASS process (lsass.exe) with specific, high-value AccessMask/AccessList values. Attackers commonly need elevated access to LSASS to obtain credential material, so handle requests to lsass.exe are a useful signal for credential-access activity. The detection relies on Windows Security auditing events 4656 and 4663/4663-family telemetry that includes ObjectName/ObjectName suffix and access right fields, with exclusions to reduce common benign tooling noise.
references:
  - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml
author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update), Huntrule Team
date: 2019-11-01
modified: 2026-10-20
tags:
  - attack.credential-access
  - car.2019-04-004
  - attack.t1003.001
logsource:
  product: windows
  service: security
detection:
  selection_1:
    EventID: 4656
    ObjectName|endswith: \lsass.exe
    AccessMask|contains:
      - "0x40"
      - "0x1400"
      - "0x1410"
      - "0x1010"
      - "0x1438"
      - "0x143a"
      - "0x1418"
      - "0x1f0fff"
      - "0x1f1fff"
      - "0x1f2fff"
      - "0x1f3fff"
  selection_2:
    EventID: 4663
    ObjectName|endswith: \lsass.exe
    AccessList|contains:
      - "4484"
      - "4416"
  filter_main_specific:
    ProcessName|endswith:
      - \csrss.exe
      - \GamingServices.exe
      - \lsm.exe
      - \MicrosoftEdgeUpdate.exe
      - \minionhost.exe
      - \MRT.exe
      - \MsMpEng.exe
      - \perfmon.exe
      - \procexp.exe
      - \procexp64.exe
      - \procexp64a.exe
      - \svchost.exe
      - \taskmgr.exe
      - \thor.exe
      - \thor64.exe
      - \vmtoolsd.exe
      - \VsTskMgr.exe
      - \wininit.exe
      - \wmiprvse.exe
      - RtkAudUService64
    ProcessName|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\ProgramData\Microsoft\Windows Defender\Platform\
      - :\Windows\SysNative\
      - :\Windows\System32\
      - :\Windows\SysWow64\
      - :\Windows\Temp\asgard2-agent\
  filter_main_generic:
    ProcessName|contains: :\Program Files
  filter_main_exact:
    ProcessName|endswith:
      - :\Windows\System32\taskhostw.exe
      - :\Windows\System32\msiexec.exe
      - :\Windows\CCM\CcmExec.exe
  filter_main_sysmon:
    ProcessName|endswith:
      - :\Windows\Sysmon64.exe
      - :\Windows\Sysmon64a.exe
    AccessList|contains: "%%4484"
  filter_main_aurora:
    ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\
    ProcessName|endswith: \aurora-agent-64.exe
    AccessList|contains: "%%4484"
  filter_main_scenarioengine:
    ProcessName|endswith: \x64\SCENARIOENGINE.EXE
    AccessList|contains: "%%4484"
  filter_main_avira1:
    ProcessName|contains|all:
      - :\Users\
      - \AppData\Local\Temp\is-
    ProcessName|endswith: \avira_system_speedup.tmp
    AccessList|contains: "%%4484"
  filter_main_avira2:
    ProcessName|contains: :\Windows\Temp\
    ProcessName|endswith: \avira_speedup_setup_update.tmp
    AccessList|contains: "%%4484"
  filter_main_snmp:
    ProcessName|endswith: :\Windows\System32\snmp.exe
    AccessList|contains: "%%4484"
  filter_main_googleupdate:
    ProcessName|contains: :\Windows\SystemTemp\
    ProcessName|endswith: \GoogleUpdate.exe
    AccessList|contains: "%%4484"
  filter_optional_procmon:
    ProcessName|endswith:
      - \procmon64.exe
      - \procmon64a.exe
      - \procmon.exe
    AccessList|contains: "%%4484"
  condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it
level: medium
license: DRL-1.1
related:
  - id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76
    type: derived