Sigma rule: Suspicious LSASS Access Via MalSecLogon

Rule

Title

Suspicious LSASS Access Via MalSecLogon

Status

test

Level

high

Author

Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems)

Date

2022-06-29

File

rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.

Log source

product

windows

category

process_access

Detection

selection:
    TargetImage|endswith: '\lsass.exe'
    SourceImage|endswith: '\svchost.exe'
    GrantedAccess: '0x14c0'
    CallTrace|contains: 'seclogon.dll'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1003.001

MITRE ATT&CK ids this rule names

• T1003.001

References

• https://twitter.com/SBousseaden/status/1541920424635912196
• https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml
• https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml