Sigma rule: Credential Dumping Tools Accessing LSASS Memory

Rule

Title

Credential Dumping Tools Accessing LSASS Memory

Status

deprecated

Level

high

Author

Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community

Date

2017/02/16

Modified

2023/11/30

File

deprecated/windows/proc_access_win_lsass_susp_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects processes requesting access to LSASS memory via suspicious access masks. This is typical for credentials dumping tools

Log source

product

windows

category

process_access

Detection

selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|startswith:
        - '0x40'
        # - '0x1000'  # minimum access requirements to query basic info from service
        # - '0x1400'
        - '0x100000'
        - '0x1410'    # car.2019-04-004
        # - '0x1010'    # car.2019-04-004
        - '0x1438'    # car.2019-04-004
        - '0x143a'    # car.2019-04-004
        - '0x1418'    # car.2019-04-004
        - '0x1f0fff'
        - '0x1f1fff'
        - '0x1f2fff'
        - '0x1f3fff'
filter_exact:
    SourceImage:
        - 'C:\WINDOWS\system32\taskmgr.exe'
        - 'C:\Windows\System32\perfmon.exe'
filter_generic:
    SourceImage|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
    GrantedAccess:
        - '0x1410'
        - '0x410'
filter_defender:
    SourceImage|startswith:
        - 'C:\ProgramData\Microsoft\Windows Defender\'
        - 'C:\Program Files\Windows Defender\'
        - 'C:\Program Files\Microsoft Security Client\MsMpEng.exe' # Windows7
    SourceImage|endswith: '\MsMpEng.exe'
filter_defender_updates:
    SourceImage: 'C:\Windows\System32\svchost.exe'
    CallTrace|contains|all:
        - '|C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{'
        - '}\mpengine.dll+'
    GrantedAccess: '0x1418'
filter_defender_calltrace:
    CallTrace|contains:
        - '|c:\program files\windows defender\mprtp.dll'
        - '|c:\program files\windows defender\MpClient.dll'
filter_gaming_services:
    SourceImage|startswith: 'C:\Program Files\WindowsApps\'
    SourceImage|endswith: '\GamingServices.exe'
    GrantedAccess:
        - '0x1410'
        - '0x410'
filter_specific_granted_access_1:
    SourceImage|endswith:
        - '\PROCEXP64.EXE'
        - '\PROCEXP.EXE'
        - 'C:\WINDOWS\system32\taskhostw.exe'
        - '\MBAMInstallerService.exe'
    GrantedAccess:
        - '0x1410'
        - '0x410'
        - '0x40'
filter_specific_granted_access_2:
    SourceImage:
        - 'C:\WINDOWS\system32\wbem\wmiprvse.exe'
        - 'C:\Windows\syswow64\MsiExec.exe'
        - 'C:\Windows\System32\msiexec.exe'
    GrantedAccess:
        - '0x1410'
        - '0x410'
        - '0x1f1fff'
        - '0x1f3fff'
filter_specific_granted_access_3:
    SourceImage:
        - 'C:\Windows\system32\wininit.exe'
        - 'C:\Windows\System32\lsass.exe'
    GrantedAccess: '0x1000000'
filter_vmwaretools:
    SourceImage|startswith: 'C:\ProgramData\VMware\VMware Tools\'
    SourceImage|endswith: '\vmtoolsd.exe'
filter_svchost:
    SourceImage: 'C:\WINDOWS\system32\svchost.exe'
    GrantedAccess:
        - '0x100000'
        - '0x1410'
filter_nextron:
    SourceImage|endswith:
        - '\thor.exe'
        - '\thor64.exe'
        - '\aurora-agent.exe'
        - '\aurora-agent-64.exe'
    GrantedAccess:
        - '0x40'
        - '0x1010'
filter_explorer:
    SourceImage|endswith: '\explorer.exe'
    GrantedAccess: '0x401'
filter_mrt:
    SourceImage: 'C:\Windows\system32\MRT.exe' # Windows Malicious Software Removal Tool
    GrantedAccess:
        - '0x1410'
        - '0x1418'
filter_handle:
    GrantedAccess: '0x40'
    SourceImage|endswith:
        - '\handle.exe'
        - '\handle64.exe'
filter_edge: # version in path 96.0.1054.43
    SourceImage|startswith: 'C:\Program Files (x86)\Microsoft\Edge\Application\'
    SourceImage|endswith: '\Installer\setup.exe'
filter_webex:
    SourceImage|endswith: '\AppData\Local\WebEx\WebexHost.exe'
    GrantedAccess: '0x401'
filter_malwarebytes:
    SourceImage: 'C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe'
    GrantedAccess: '0x1410'
filter_dropbox:
    SourceImage|contains:
        - ':\Windows\Temp\'
        - '\AppData\Local\Temp\'
    SourceImage|endswith: '.tmp\DropboxUpdate.exe'
    GrantedAccess:
        - '0x410'
        - '0x1410'
filter_msbuild:
    # This FP was generated while building CPython from source and could be related to other similar examples.
    # But if you don't do that kind of stuff consider removing it from the rule ;)
    SourceImage|startswith: 'C:\Program Files\Microsoft Visual Studio\'
    SourceImage|endswith: '\MSBuild\Current\Bin\MSBuild.exe'
    GrantedAccess: '0x1F3FFF'
# Old - too broad filter
    # SourceImage|endswith: # easy to bypass. need to implement supportive rule to detect bypass attempts
    #     - '\wmiprvse.exe'
    #     - '\taskmgr.exe'
    #     - '\procexp64.exe'
    #     - '\procexp.exe'
    #     - '\lsm.exe'
    #     - '\MsMpEng.exe'
    #     - '\csrss.exe'
    #     - '\wininit.exe'
    #     - '\vmtoolsd.exe'
filter_games:
    SourceImage|contains: '\SteamLibrary\steamapps\'
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Likely

Tags

• attack.credential_access
• attack.t1003.001
• attack.s0002
• car.2019-04-004

MITRE ATT&CK ids this rule names

• S0002
• T1003.001

References

• https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
• https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
• https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/proc_access_win_lsass_susp_access.yml