{"id":"4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76","title":"Potentially Suspicious AccessMask Requested From LSASS","description":"Detects process handle on LSASS process with certain access mask","author":"Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)","status":"test","level":"medium","date":"2019-11-01","modified":"2023-12-19","tags":["attack.credential-access","car.2019-04-004","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it"],"references":["https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html","https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment"],"source_path":"rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml","source_sha256":"b59c52f9220b87579f40ad8740e7595bb271cfb45f516aee443ec8a8050e4546","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious AccessMask Requested From LSASS\nid: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76\nstatus: test\ndescription: Detects process handle on LSASS process with certain access mask\nreferences:\n    - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html\n    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\nauthor: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)\ndate: 2019-11-01\nmodified: 2023-12-19\ntags:\n    - attack.credential-access\n    - car.2019-04-004\n    - attack.t1003.001\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_1:\n        EventID: 4656 # A handle to an object was requested.\n        ObjectName|endswith: '\\lsass.exe'\n        AccessMask|contains:\n            - '0x40'\n            - '0x1400'\n            # - '0x1000'  # minimum access requirements to query basic info from service\n            - '0x100000'\n            - '0x1410'    # car.2019-04-004\n            - '0x1010'    # car.2019-04-004\n            - '0x1438'    # car.2019-04-004\n            - '0x143a'    # car.2019-04-004\n            - '0x1418'    # car.2019-04-004\n            - '0x1f0fff'\n            - '0x1f1fff'\n            - '0x1f2fff'\n            - '0x1f3fff'\n    selection_2:\n        EventID: 4663 # An attempt was made to access an object\n        ObjectName|endswith: '\\lsass.exe'\n        AccessList|contains:\n            - '4484'\n            - '4416'\n    filter_main_specific:\n        ProcessName|endswith:\n            - '\\csrss.exe'\n            - '\\GamingServices.exe'\n            - '\\lsm.exe'\n            - '\\MicrosoftEdgeUpdate.exe'\n            - '\\minionhost.exe'  # Cyberreason\n            - '\\MRT.exe'         # MS Malware Removal Tool\n            - '\\MsMpEng.exe'     # Defender\n            - '\\perfmon.exe'\n            - '\\procexp.exe'\n            - '\\procexp64.exe'\n            - '\\svchost.exe'\n            - '\\taskmgr.exe'\n            - '\\thor.exe'        # THOR\n            - '\\thor64.exe'      # THOR\n            - '\\vmtoolsd.exe'\n            - '\\VsTskMgr.exe'    # McAfee Enterprise\n            - '\\wininit.exe'\n            - '\\wmiprvse.exe'\n            - 'RtkAudUService64' # https://medium.com/falconforce/the-curious-case-of-realtek-and-lsass-33fc0c8482ff\n        ProcessName|contains:\n            - ':\\Program Files (x86)\\'\n            - ':\\Program Files\\'\n            - ':\\ProgramData\\Microsoft\\Windows Defender\\Platform\\'\n            - ':\\Windows\\SysNative\\'\n            - ':\\Windows\\System32\\'\n            - ':\\Windows\\SysWow64\\'\n            - ':\\Windows\\Temp\\asgard2-agent\\'\n    filter_main_generic:\n        ProcessName|contains: ':\\Program Files'  # too many false positives with legitimate AV and EDR solutions\n    filter_main_exact:\n        ProcessName|endswith:\n            - ':\\Windows\\System32\\taskhostw.exe'\n            - ':\\Windows\\System32\\msiexec.exe'\n            - ':\\Windows\\CCM\\CcmExec.exe'\n    filter_main_sysmon:\n        ProcessName|endswith: ':\\Windows\\Sysmon64.exe'\n        AccessList|contains: '%%4484'\n    filter_main_aurora:\n        ProcessName|contains: ':\\Windows\\Temp\\asgard2-agent-sc\\aurora\\'\n        ProcessName|endswith: '\\aurora-agent-64.exe'\n        AccessList|contains: '%%4484'\n    filter_main_scenarioengine:\n        # Example: C:\\a70de9569c3a5aa22184ef52a890177b\\x64\\SCENARIOENGINE.EXE\n        ProcessName|endswith: '\\x64\\SCENARIOENGINE.EXE'\n        AccessList|contains: '%%4484'\n    filter_main_avira1:\n        ProcessName|contains|all:\n            - ':\\Users\\'\n            - '\\AppData\\Local\\Temp\\is-'\n        ProcessName|endswith: '\\avira_system_speedup.tmp'\n        AccessList|contains: '%%4484'\n    filter_main_avira2:\n        ProcessName|contains: ':\\Windows\\Temp\\'\n        ProcessName|endswith: '\\avira_speedup_setup_update.tmp'\n        AccessList|contains: '%%4484'\n    filter_main_snmp:\n        ProcessName|endswith: ':\\Windows\\System32\\snmp.exe'\n        AccessList|contains: '%%4484'\n    filter_main_googleupdate:\n        ProcessName|contains: ':\\Windows\\SystemTemp\\'\n        ProcessName|endswith: '\\GoogleUpdate.exe'\n        AccessList|contains: '%%4484'\n    filter_optional_procmon:\n        ProcessName|endswith:\n            - '\\procmon64.exe'\n            - '\\procmon.exe'\n        AccessList|contains: '%%4484'\n    condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76.json","kind":"sigma"}