Windows Security Log LSASS Access by Non-Computer Account Process

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security audit events (4663/4656) where a process attempts access to \lsass.exe using access masks consistent with credential-stealing tools. Attackers may target LSASS to extract credentials, making this behavior high risk even when the access is partial or indirect. It relies on process-object access telemetry and filters out common service/computer account patterns and likely benign process paths (e.g., Program Files software and WmiPrvSE-specific access).

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows Security Log LSASS Access by Non-Computer Account Process

Pivot detection · T1003.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-event-detects-lsass-process-access-from-non-system-account-962fe167

title: Windows Security Log LSASS Access by Non-Computer Account Process
id: 3e0e3a96-68cc-4c80-a6b0-87520b342142
status: test
description: This rule flags Windows Security audit events (4663/4656) where a process attempts access to \lsass.exe using access masks consistent with credential-stealing tools. Attackers may target LSASS to extract credentials, making this behavior high risk even when the access is partial or indirect. It relies on process-object access telemetry and filters out common service/computer account patterns and likely benign process paths (e.g., Program Files software and WmiPrvSE-specific access).
references:
  - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-06-20
modified: 2023-12-11
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4663
      - 4656
    AccessMask:
      - "0x100000"
      - "0x1010"
      - "0x1400"
      - "0x1410"
      - "0x1418"
      - "0x1438"
      - "0x143a"
      - "0x1f0fff"
      - "0x1f1fff"
      - "0x1f2fff"
      - "0x1f3fff"
      - "0x40"
      - 143a
      - 1f0fff
      - 1f1fff
      - 1f2fff
      - 1f3fff
    ObjectType: Process
    ObjectName|endswith: \lsass.exe
  filter_main_service_account:
    SubjectUserName|endswith: $
  filter_main_generic:
    ProcessName|contains:
      - :\Program Files\
      - :\Program Files (x86)\
  filter_main_wmiprvse:
    ProcessName: C:\Windows\System32\wbem\WmiPrvSE.exe
    AccessMask: "0x1410"
  filter_optional_steam:
    ProcessName|contains: \SteamLibrary\steamapps\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 962fe167-e48d-4fd6-9974-11e5b9a5d6d1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL