huntrule

Windows Security Event Detects LSASS Process Access from Non-System Account

Alerts on suspicious LSASS access attempts (4663/4656) targeting lsass.exe by non-system processes using flagged access masks.

FreeUnreviewedSigmamediumv1
title: Windows Security Event Detects LSASS Process Access from Non-System Account
id: 3e0e3a96-68cc-4c80-a6b0-87520b342142
status: test
description: This rule flags Windows Security auditing events where a non-system account attempts to access \\lsass.exe with specific access masks commonly associated with LSASS memory reads. Such activity is frequently used by credential theft tools (including Mimikatz-like behavior) to extract sensitive credentials from process memory. It relies on Security events 4663/4656 that record object access attempts and process object details, plus filtering to reduce noise from typical system/service accounts and known binaries.
references:
  - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-06-20
modified: 2023-12-11
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4663
      - 4656
    AccessMask:
      - "0x100000"
      - "0x1010"
      - "0x1400"
      - "0x1410"
      - "0x1418"
      - "0x1438"
      - "0x143a"
      - "0x1f0fff"
      - "0x1f1fff"
      - "0x1f2fff"
      - "0x1f3fff"
      - "0x40"
      - 143a
      - 1f0fff
      - 1f1fff
      - 1f2fff
      - 1f3fff
    ObjectType: Process
    ObjectName|endswith: \lsass.exe
  filter_main_service_account:
    SubjectUserName|endswith: $
  filter_main_generic:
    ProcessName|contains:
      - :\Program Files\
      - :\Program Files (x86)\
  filter_main_wmiprvse:
    ProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe
    AccessMask: "0x1410"
  filter_optional_steam:
    ProcessName|contains: \SteamLibrary\steamapps\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 962fe167-e48d-4fd6-9974-11e5b9a5d6d1
    type: derived

What it detects

This rule flags Windows Security auditing events where a non-system account attempts to access \\lsass.exe with specific access masks commonly associated with LSASS memory reads. Such activity is frequently used by credential theft tools (including Mimikatz-like behavior) to extract sensitive credentials from process memory. It relies on Security events 4663/4656 that record object access attempts and process object details, plus filtering to reduce noise from typical system/service accounts and known binaries.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.