Sigma rule: LSASS Access From Program In Potentially Suspicious Folder

Rule

Title

LSASS Access From Program In Potentially Suspicious Folder

Status

test

Level

medium

Author

Florian Roth (Nextron Systems)

Date

2021-11-27

Modified

2026-09-15

File

rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder

Log source

product

windows

category

process_access

Detection

selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|endswith:
        - '10'
        - '30'
        - '50'
        - '70'
        - '90'
        - 'B0'
        - 'D0'
        - 'F0'
        - '18'
        - '38'
        - '58'
        - '78'
        - '98'
        - 'B8'
        - 'D8'
        - 'F8'
        - '1A'
        - '3A'
        - '5A'
        - '7A'
        - '9A'
        - 'BA'
        - 'DA'
        - 'FA'
        - '0x14C2'  # https://github.com/b4rtik/ATPMiniDump/blob/76304f93b390af3bb66e4f451ca16562a479bdc9/ATPMiniDump/ATPMiniDump.c
        - 'FF'
    SourceImage|contains:
        - '\Temp\'
        - '\Users\Public\'
        - '\PerfLogs\'
        - '\AppData\'
        - '\Temporary'
filter_optional_generic_appdata:
    SourceImage|contains|all:
        - ':\Users\'
        - '\AppData\Local\'
    SourceImage|endswith:
        - '\Microsoft VS Code\Code.exe'
        - '\software_reporter_tool.exe'
        - '\DropboxUpdate.exe'
        - '\MBAMInstallerService.exe'
        - '\WebexMTA.exe'
        - '\Meetings\WebexMTAV2.exe'
        - '\WebEx\WebexHost.exe'
        - '\JetBrains\Toolbox\bin\jetbrains-toolbox.exe'
    GrantedAccess: '0x410'
filter_optional_dropbox_1:
    SourceImage|contains: ':\Windows\Temp\'
    SourceImage|endswith: '.tmp\DropboxUpdate.exe'
    GrantedAccess:
        - '0x410'
        - '0x1410'
filter_optional_dropbox_2:
    SourceImage|contains|all:
        - ':\Users\'
        - '\AppData\Local\Temp\'
    SourceImage|endswith: '.tmp\DropboxUpdate.exe'
    GrantedAccess: '0x1410'
filter_optional_dropbox_3:
    SourceImage|contains:
        - ':\Program Files (x86)\Dropbox\'
        - ':\Program Files\Dropbox\'
    SourceImage|endswith: '\DropboxUpdate.exe'
    GrantedAccess: '0x1410'
filter_optional_nextron:
    SourceImage|contains:
        - ':\Windows\Temp\asgard2-agent\'
        - ':\Windows\Temp\asgard2-agent-sc\'
    SourceImage|endswith:
        - '\thor64.exe'
        - '\thor.exe'
        - '\aurora-agent-64.exe'
        - '\aurora-agent.exe'
    GrantedAccess:
        - '0x1fffff'
        - '0x1010'
        - '0x101010'
filter_optional_ms_products:
    SourceImage|contains|all:
        - ':\Users\'
        - '\AppData\Local\Temp\'
        - '\vs_bootstrapper_'
    GrantedAccess: '0x1410'
filter_optional_chrome_update:
    SourceImage|contains: ':\Program Files (x86)\Google\Temp\'
    SourceImage|endswith: '.tmp\GoogleUpdate.exe'
    GrantedAccess:
        - '0x410'
        - '0x1410'
filter_optional_keybase:
    SourceImage|contains: ':\Users\'
    SourceImage|endswith: \AppData\Local\Keybase\keybase.exe
    GrantedAccess: '0x1fffff'
filter_optional_avira:
    SourceImage|contains: '\AppData\Local\Temp\is-'
    SourceImage|endswith: '.tmp\avira_system_speedup.tmp'
    GrantedAccess: '0x1410'
filter_optional_viberpc_updater:
    SourceImage|contains: '\AppData\Roaming\ViberPC\'
    SourceImage|endswith: '\updater.exe'
    TargetImage|endswith: '\winlogon.exe'
    GrantedAccess: '0x1fffff'
filter_optional_adobe_arm_helper:
    SourceImage|contains:  # Example path: 'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp\2092867405\AdobeARMHelper.exe'
        - ':\Program Files\Common Files\Adobe\ARM\'
        - ':\Program Files (x86)\Common Files\Adobe\ARM\'
    SourceImage|endswith: '\AdobeARMHelper.exe'
    GrantedAccess: '0x1410'
filter_optional_malwarebytes:
    SourceImage|endswith: '\MBAMInstallerService.exe'
    GrantedAccess: '0x1410'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Updaters and installers are typical false positives. Apply custom filters depending on your environment

Tags

• attack.credential-access
• attack.t1003.001
• attack.s0002
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• S0002
• T1003.001

References

• https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
• https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
• https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
• https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_access/proc_access_win_lsass_susp_source_process.yml