Detection rules › Elastic

Potential Credential Access via DuplicateHandle in LSASS

Author
Elastic
Source
upstream

Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping, T1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Sysmon10ProcessAccess

Stages and Predicates

Stage 1: eql:process

process.name:"lsass.exe" and winlog.event_data.CallTrace:"UNKNOWN" and winlog.event_data.GrantedAccess:0x40

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
process.namewildcard
  • lsass.exe
winlog.event_data.CallTracewildcard
  • *UNKNOWN* corpus 2 (elastic 2)
winlog.event_data.GrantedAccesseq
  • 0x40 corpus 2 (sigma 1, elastic 1)