Sigma rule: Potentially Suspicious AccessMask Requested From LSASS

Rule

Title

Potentially Suspicious AccessMask Requested From LSASS

Status

test

Level

medium

Author

Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)

Date

2019-11-01

Modified

2026-10-20

File

rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects process handle on LSASS process with certain access mask

Log source

product

windows

service

security

Detection

selection_1:
    EventID: 4656 # A handle to an object was requested.
    ObjectName|endswith: '\lsass.exe'
    AccessMask|contains:
        - '0x40'
        - '0x1400'
        # - '0x1000'  # minimum access requirements to query basic info from service
        # - '0x100000'  # SYNCHRONIZE - cannot be used for credential dumping; high FP rate from AV/EDR agents synchronizing on LSASS
        - '0x1410'    # car.2019-04-004
        - '0x1010'    # car.2019-04-004
        - '0x1438'    # car.2019-04-004
        - '0x143a'    # car.2019-04-004
        - '0x1418'    # car.2019-04-004
        - '0x1f0fff'
        - '0x1f1fff'
        - '0x1f2fff'
        - '0x1f3fff'
selection_2:
    EventID: 4663 # An attempt was made to access an object
    ObjectName|endswith: '\lsass.exe'
    AccessList|contains:
        - '4484'
        - '4416'
filter_main_specific:
    ProcessName|endswith:
        - '\csrss.exe'
        - '\GamingServices.exe'
        - '\lsm.exe'
        - '\MicrosoftEdgeUpdate.exe'
        - '\minionhost.exe'  # Cyberreason
        - '\MRT.exe'         # MS Malware Removal Tool
        - '\MsMpEng.exe'     # Defender
        - '\perfmon.exe'
        - '\procexp.exe'
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\svchost.exe'
        - '\taskmgr.exe'
        - '\thor.exe'        # THOR
        - '\thor64.exe'      # THOR
        - '\vmtoolsd.exe'
        - '\VsTskMgr.exe'    # McAfee Enterprise
        - '\wininit.exe'
        - '\wmiprvse.exe'
        - 'RtkAudUService64' # https://medium.com/falconforce/the-curious-case-of-realtek-and-lsass-33fc0c8482ff
    ProcessName|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\ProgramData\Microsoft\Windows Defender\Platform\'
        - ':\Windows\SysNative\'
        - ':\Windows\System32\'
        - ':\Windows\SysWow64\'
        - ':\Windows\Temp\asgard2-agent\'
filter_main_generic:
    ProcessName|contains: ':\Program Files'  # too many false positives with legitimate AV and EDR solutions
filter_main_exact:
    ProcessName|endswith:
        - ':\Windows\System32\taskhostw.exe'
        - ':\Windows\System32\msiexec.exe'
        - ':\Windows\CCM\CcmExec.exe'
filter_main_sysmon:
    ProcessName|endswith:
        - ':\Windows\Sysmon64.exe'
        - ':\Windows\Sysmon64a.exe'
    AccessList|contains: '%%4484'
filter_main_aurora:
    ProcessName|contains: ':\Windows\Temp\asgard2-agent-sc\aurora\'
    ProcessName|endswith: '\aurora-agent-64.exe'
    AccessList|contains: '%%4484'
filter_main_scenarioengine:
    # Example: C:\a70de9569c3a5aa22184ef52a890177b\x64\SCENARIOENGINE.EXE
    ProcessName|endswith: '\x64\SCENARIOENGINE.EXE'
    AccessList|contains: '%%4484'
filter_main_avira1:
    ProcessName|contains|all:
        - ':\Users\'
        - '\AppData\Local\Temp\is-'
    ProcessName|endswith: '\avira_system_speedup.tmp'
    AccessList|contains: '%%4484'
filter_main_avira2:
    ProcessName|contains: ':\Windows\Temp\'
    ProcessName|endswith: '\avira_speedup_setup_update.tmp'
    AccessList|contains: '%%4484'
filter_main_snmp:
    ProcessName|endswith: ':\Windows\System32\snmp.exe'
    AccessList|contains: '%%4484'
filter_main_googleupdate:
    ProcessName|contains: ':\Windows\SystemTemp\'
    ProcessName|endswith: '\GoogleUpdate.exe'
    AccessList|contains: '%%4484'
filter_optional_procmon:
    ProcessName|endswith:
        - '\procmon64.exe'
        - '\procmon64a.exe'
        - '\procmon.exe'
    AccessList|contains: '%%4484'
condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it

Tags

• attack.credential-access
• car.2019-04-004
• attack.t1003.001

MITRE ATT&CK ids this rule names

• T1003.001

References

• https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml