{"id":"a18dd26b-6450-46de-8c91-9659150cf088","title":"Potentially Suspicious GrantedAccess Flags On LSASS","description":"Detects process access requests to LSASS process with potentially suspicious access flags","author":"Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community","status":"test","level":"medium","date":"2021-11-22","modified":"2023-11-29","tags":["attack.credential-access","attack.t1003.001","attack.s0002"],"technique_ids":["T1003.001"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Legitimate software such as AV and EDR"],"references":["https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights","https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow","https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html","https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment","https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf"],"source_path":"rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml","source_sha256":"5372dcb3e84578cbb7afbf3b3fcafd3a0e701297c284b73c2925c390905ced82","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious GrantedAccess Flags On LSASS\nid: a18dd26b-6450-46de-8c91-9659150cf088\nrelated:\n    - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d\n      type: similar\nstatus: test\ndescription: Detects process access requests to LSASS process with potentially suspicious access flags\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights\n    - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow\n    - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html\n    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment\n    - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf\nauthor: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community\ndate: 2021-11-22\nmodified: 2023-11-29\ntags:\n    - attack.credential-access\n    - attack.t1003.001\n    - attack.s0002\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection_target:\n        TargetImage|endswith: '\\lsass.exe'\n    selection_access:\n        - GrantedAccess|endswith:\n              # - '10'  # covered in rule 678dfc63-fefb-47a5-a04c-26bcf8cc9f65\n              - '30'\n              - '50'\n              - '70'\n              - '90'\n              - 'B0'\n              - 'D0'\n              - 'F0'\n              - '18'\n              - '38'\n              - '58'\n              - '78'\n              - '98'\n              - 'B8'\n              - 'D8'\n              - 'F8'\n              - '1A'\n              - '3A'\n              - '5A'\n              - '7A'\n              - '9A'\n              - 'BA'\n              - 'DA'\n              - 'FA'\n              - '0x14C2'  # https://github.com/b4rtik/ATPMiniDump/blob/76304f93b390af3bb66e4f451ca16562a479bdc9/ATPMiniDump/ATPMiniDump.c\n        - GrantedAccess|startswith:\n              - '0x100000'\n              - '0x1418'    # car.2019-04-004\n              - '0x1438'    # car.2019-04-004\n              - '0x143a'    # car.2019-04-004\n              - '0x1f0fff'\n              - '0x1f1fff'\n              - '0x1f2fff'\n              - '0x1f3fff'\n              - '0x40'\n              # - '0x1000'  # minimum access requirements to query basic info from service\n              # - '0x1010'    # car.2019-04-004\n              # - '0x1400'\n              # - '0x1410'    # car.2019-04-004 # Covered by 678dfc63-fefb-47a5-a04c-26bcf8cc9f65\n    filter_main_generic:\n        # When using this rule. Remove this filter and replace it by the path of the specific AV you use\n        SourceImage|contains:\n            - ':\\Program Files (x86)\\'\n            - ':\\Program Files\\'\n            - ':\\Windows\\System32\\'\n            - ':\\Windows\\SysWOW64\\'\n    filter_optional_malwarebytes:\n        SourceImage|endswith: ':\\ProgramData\\MALWAREBYTES\\MBAMSERVICE\\ctlrupdate\\mbupdatr.exe'\n    filter_optional_vscode:\n        SourceImage|endswith: '\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe'\n    filter_main_windefend_1:\n        SourceImage|contains: ':\\ProgramData\\Microsoft\\Windows Defender\\'\n        SourceImage|endswith: '\\MsMpEng.exe'\n    filter_main_windefend_2:\n        CallTrace|contains|all:\n            - '|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{'\n            - '}\\mpengine.dll+'\n        GrantedAccess: '0x1418'\n    filter_main_windefend_3:\n        CallTrace|contains:\n            - '|c:\\program files\\windows defender\\mprtp.dll'\n            - '|c:\\program files\\windows defender\\MpClient.dll'\n    filter_optional_vmwaretools:\n        SourceImage|contains: ':\\ProgramData\\VMware\\VMware Tools\\'\n        SourceImage|endswith: '\\vmtoolsd.exe'\n    filter_optional_sysinternals_process_explorer:\n        SourceImage|endswith:\n            - '\\PROCEXP64.EXE'\n            - '\\PROCEXP.EXE'\n        GrantedAccess: '0x40'\n    filter_optional_mbami:\n        SourceImage|endswith: '\\MBAMInstallerService.exe'\n        GrantedAccess: '0x40'\n    filter_optional_nextron:\n        SourceImage|endswith:\n            - '\\aurora-agent-64.exe'\n            - '\\aurora-agent.exe'\n            - '\\thor.exe'\n            - '\\thor64.exe'\n        GrantedAccess: '0x40'\n    filter_main_explorer:\n        SourceImage|endswith: '\\explorer.exe'\n        GrantedAccess: '0x401'\n    filter_optional_sysinternals_handle:\n        SourceImage|endswith:\n            - '\\handle.exe'\n            - '\\handle64.exe'\n        GrantedAccess: '0x40'\n    filter_optional_webex:\n        SourceImage|endswith: '\\AppData\\Local\\WebEx\\WebexHost.exe'\n        GrantedAccess: '0x401'\n    filter_optional_steam_apps:\n        SourceImage|contains: '\\SteamLibrary\\steamapps\\'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate software such as AV and EDR\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/a18dd26b-6450-46de-8c91-9659150cf088.json","kind":"sigma"}