{"id":"a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98","title":"LSASS Access Detected via Attack Surface Reduction","description":"Detects Access to LSASS Process","author":"Markus Neis","status":"test","level":"high","date":"2018-08-26","modified":"2022-08-13","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","service":"windefend","definition":"Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)"},"falsepositives":["Google Chrome GoogleUpdate.exe","Some Taskmgr.exe related activity"],"references":["https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction"],"source_path":"rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml","source_sha256":"0348816ebc3d42c5d78b07692445a356b7cd0a2d49195387be0bc86c02c6239d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/windefend/win_defender_asr_lsass_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSASS Access Detected via Attack Surface Reduction\nid: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98\nstatus: test\ndescription: Detects Access to LSASS Process\nreferences:\n    - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction\nauthor: Markus Neis\ndate: 2018-08-26\nmodified: 2022-08-13\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    service: windefend\n    definition: 'Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)'\ndetection:\n    selection:\n        EventID: 1121\n        Path|endswith: '\\lsass.exe'\n    filter_thor:\n        ProcessName|startswith: 'C:\\Windows\\Temp\\asgard2-agent\\'\n        ProcessName|endswith:\n            - '\\thor64.exe'\n            - '\\thor.exe'\n    filter_exact:\n        ProcessName:\n            - 'C:\\Windows\\System32\\atiesrxx.exe'\n            - 'C:\\Windows\\System32\\CompatTelRunner.exe'\n            - 'C:\\Windows\\System32\\msiexec.exe'\n            - 'C:\\Windows\\System32\\nvwmi64.exe'\n            - 'C:\\Windows\\System32\\svchost.exe'\n            - 'C:\\Windows\\System32\\Taskmgr.exe'\n            - 'C:\\Windows\\System32\\wbem\\WmiPrvSE.exe'\n            - 'C:\\Windows\\SysWOW64\\msiexec.exe'\n    filter_begins:\n        ProcessName|startswith:\n            - 'C:\\Windows\\System32\\DriverStore\\'\n            - 'C:\\WINDOWS\\Installer\\'\n            - 'C:\\Program Files\\'\n            - 'C:\\Program Files (x86)\\'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Google Chrome GoogleUpdate.exe\n    - Some Taskmgr.exe related activity\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98.json","kind":"sigma"}