huntrule

Windows Security: Password Dumping via LSASS Handle Access (SAM_DOMAIN)

Flags handle opens to lsass.exe with access mask 0x705 targeting SAM_DOMAIN, indicative of credential dumping.

FreeUnreviewedSigmahighv1
title: "Windows Security: Password Dumping via LSASS Handle Access (SAM_DOMAIN)"
id: e702c0bf-67bd-409c-9681-8b5a6bab939b
status: test
description: This rule identifies Windows Security events where a process opens a handle to lsass.exe with an access mask of 0x705 and targets the object type SAM_DOMAIN. Such access is consistent with credential dumping behavior aimed at extracting authentication material from LSASS. The detection relies on event telemetry from Security log EventID 4656, including the accessed process name, access mask, and object type.
references:
  - https://twitter.com/jackcr/status/807385668833968128
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump.yml
author: sigma, Huntrule Team
date: 2017-02-12
modified: 2022-10-09
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4656
    ProcessName|endswith: \lsass.exe
    AccessMask: "0x705"
    ObjectType: SAM_DOMAIN
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c
    type: derived

What it detects

This rule identifies Windows Security events where a process opens a handle to lsass.exe with an access mask of 0x705 and targets the object type SAM_DOMAIN. Such access is consistent with credential dumping behavior aimed at extracting authentication material from LSASS. The detection relies on event telemetry from Security log EventID 4656, including the accessed process name, access mask, and object type.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.