Sigma rule: LSASS Access From Non System Account

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-047b7fb38881, updated 2026-10-20T00:00:00.000Z.

Rule

Title
LSASS Access From Non System Account
Status
test
Level
medium
Author
Roberto Rodriguez @Cyb3rWard0g
Date
2019-06-20
Modified
2026-10-20
File
rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential mimikatz-like tools accessing LSASS from non system account

Log source

product
windows
service
security

Detection

selection:
    EventID:
        - 4663
        - 4656
    AccessMask:
        # - '0x100000'  # SYNCHRONIZE - cannot be used for credential dumping; high FP rate from AV/EDR agents synchronizing on LSASS
        - '0x1010'    # car.2019-04-004
        - '0x1400'
        - '0x1410'    # car.2019-04-004
        - '0x1418'    # car.2019-04-004
        - '0x1438'    # car.2019-04-004
        - '0x143a'    # car.2019-04-004
        - '0x1f0fff'
        - '0x1f1fff'
        - '0x1f2fff'
        - '0x1f3fff'
        - '0x40'
        - '143a'    # car.2019-04-004
        - '1f0fff'
        - '1f1fff'
        - '1f2fff'
        - '1f3fff'
        # - '0x1000'  # minimum access requirements to query basic info from service
    ObjectType: 'Process'
    ObjectName|endswith: '\lsass.exe'
filter_main_service_account:
    SubjectUserName|endswith: '$'
filter_main_generic:
    ProcessName|contains:
        # Legitimate AV and EDR solutions
        - ':\Program Files\'
        - ':\Program Files (x86)\'
filter_main_wmiprvse:
    ProcessName: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
    AccessMask: '0x1410'
filter_optional_steam:
    ProcessName|contains: '\SteamLibrary\steamapps\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

  • Unknown

Tags

  • attack.credential-access
  • attack.t1003.001

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml

Sources and licences

  • SigmaHQ

    "LSASS Access From Non System Account" by Roberto Rodriguez @Cyb3rWard0g (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_lsass_access_non_system_account.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: LSASS Access From Non System Account",
entity page, dataset version ref-047b7fb38881, updated 2026-10-20T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/962fe167-e48d-4fd6-9974-11e5b9a5d6d1 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 962fe167-e48d-4fd6-9974-11e5b9a5d6d1, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.