Windows Security Log LSASS Access by Non-Computer Account Process
Alerts on suspicious LSASS access attempts (4663/4656) targeting lsass.exe by non-system processes using flagged access masks.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
- Published
- 2019-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Security audit events (4663/4656) where a process attempts access to \lsass.exe using access masks consistent with credential-stealing tools. Attackers may target LSASS to extract credentials, making this behavior high risk even when the access is partial or indirect. It relies on process-object access telemetry and filters out common service/computer account patterns and likely benign process paths (e.g., Program Files software and WmiPrvSE-specific access).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Log LSASS Access by Non-Computer Account Process
id: 3e0e3a96-68cc-4c80-a6b0-87520b342142
status: test
description: This rule flags Windows Security audit events (4663/4656) where a process attempts access to \lsass.exe using access masks consistent with credential-stealing tools. Attackers may target LSASS to extract credentials, making this behavior high risk even when the access is partial or indirect. It relies on process-object access telemetry and filters out common service/computer account patterns and likely benign process paths (e.g., Program Files software and WmiPrvSE-specific access).
references:
- https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-06-20
modified: 2023-12-11
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
service: security
detection:
selection:
EventID:
- 4663
- 4656
AccessMask:
- "0x100000"
- "0x1010"
- "0x1400"
- "0x1410"
- "0x1418"
- "0x1438"
- "0x143a"
- "0x1f0fff"
- "0x1f1fff"
- "0x1f2fff"
- "0x1f3fff"
- "0x40"
- 143a
- 1f0fff
- 1f1fff
- 1f2fff
- 1f3fff
ObjectType: Process
ObjectName|endswith: \lsass.exe
filter_main_service_account:
SubjectUserName|endswith: $
filter_main_generic:
ProcessName|contains:
- :\Program Files\
- :\Program Files (x86)\
filter_main_wmiprvse:
ProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe
AccessMask: "0x1410"
filter_optional_steam:
ProcessName|contains: \SteamLibrary\steamapps\
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 962fe167-e48d-4fd6-9974-11e5b9a5d6d1
type: derived