Sigma rule: Uncommon GrantedAccess Flags On LSASS

Rule

Title

Uncommon GrantedAccess Flags On LSASS

Status

test

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2022-03-13

Modified

2023-11-30

File

rules-threat-hunting/windows/process_access/proc_access_win_lsass_uncommon_access_flag.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410

Log source

product

windows

category

process_access

Detection

selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|endswith: '10'
# Absolute paths to programs that cause false positives
filter1:
    SourceImage:
        - 'C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHOST.exe'
        - 'C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe'
        - 'C:\Program Files\Windows Defender\MsMpEng.exe'
        - 'C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe'
        - 'C:\Windows\System32\lsass.exe'
        - 'C:\Windows\System32\msiexec.exe'
        - 'C:\WINDOWS\System32\perfmon.exe'
        - 'C:\WINDOWS\system32\taskhostw.exe'
        - 'C:\WINDOWS\system32\taskmgr.exe'
        - 'C:\WINDOWS\system32\wbem\wmiprvse.exe'
        - 'C:\Windows\SysWOW64\msiexec.exe'
        - 'C:\Windows\sysWOW64\wbem\wmiprvse.exe'
# Windows Defender
filter2:
    SourceImage|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
    SourceImage|endswith: '\MsMpEng.exe'
# Microsoft Gaming Services
filter3:
    SourceImage|startswith: 'C:\Program Files\WindowsApps\'
    SourceImage|endswith: '\GamingServices.exe'
# Process Explorer
filter4:
    SourceImage|endswith:
        - '\PROCEXP64.EXE'
        - '\PROCEXP.EXE'
# VMware Tools
filter5:
    SourceImage|startswith: 'C:\ProgramData\VMware\VMware Tools\'
    SourceImage|endswith: '\vmtoolsd.exe'
# Antivirus and EDR agents
filter6:
    SourceImage|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
    SourceImage|contains: 'Antivirus'
filter_nextron:
    # SourceImage|startswith: 'C:\Windows\Temp\asgard2-agent\'  # Can be a manual THOR installation
    SourceImage|endswith:
        - '\thor64.exe'
        - '\thor.exe'
        - '\aurora-agent-64.exe'
        - '\aurora-agent.exe'
filter_ms_products:
    SourceImage|contains|all:
        - '\AppData\Local\Temp\'
        - '\vs_bootstrapper_'
    GrantedAccess: '0x1410'
# Generic Filter for 0x1410 filter (caused by so many programs like DropBox updates etc.)
filter_generic:
    SourceImage|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
        - 'C:\WINDOWS\system32\'
filter_wer:
    SourceCommandLine: 'C:\WINDOWS\system32\wermgr.exe -upload'
filter_localappdata:
    SourceImage|contains|all:
        - 'C:\Users\'
        - '\AppData\Local\'
    SourceImage|endswith:
        - '\Microsoft VS Code\Code.exe'
        - '\software_reporter_tool.exe'
        - '\DropboxUpdate.exe'
        - '\MBAMInstallerService.exe'
        - '\WebEx\WebexHost.exe'
        - '\Programs\Microsoft VS Code\Code.exe'
        - '\JetBrains\Toolbox\bin\jetbrains-toolbox.exe'
filter_xampp:
    SourceImage|endswith: '\xampp-control.exe'
    GrantedAccess: '0x410'
filter_games:
    SourceImage|contains: '\SteamLibrary\steamapps\'
    GrantedAccess:
        - '0x410'
        - '0x10'
condition: selection and not 1 of filter*

False positives (as the rule lists them)

• Legitimate software accessing LSASS process for legitimate reason

Tags

• attack.credential-access
• attack.t1003.001
• attack.s0002
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• S0002
• T1003.001

Related rules

• 32d0d3e2-e58d-4d41-926b-18b520b2b32d (obsolete)

References

• https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
• https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
• https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
• https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_access/proc_access_win_lsass_uncommon_access_flag.yml