Windows WinRM wsmprovhost Accessing LSASS Process (lsass.exe) Remotely

title: Windows WinRM wsmprovhost Accessing LSASS Process (lsass.exe) Remotely
id: b483d773-0c48-46fa-87bb-9bff4d5b5f03
status: stable
description: This rule identifies process-access events where the LSASS process (lsass.exe) is targeted for access from the WinRM provider host process (wsmprovhost.exe). Remote access to LSASS is a common prerequisite for credential theft and related post-compromise activity, making it high-signal for attacker behavior. It relies on Windows process-access telemetry that includes SourceImage, TargetImage, and GrantedAccess.
references:
  - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml
author: Patryk Prauze - ING Tech, Huntrule Team
date: 2019-05-20
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.execution
  - attack.t1003.001
  - attack.t1059.001
  - attack.lateral-movement
  - attack.t1021.006
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|endswith: :\Windows\system32\wsmprovhost.exe
  filter_main_access:
    GrantedAccess: "0x80000000"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: aa35a627-33fb-4d04-a165-d33b4afca3e8
    type: derived