Potentially Suspicious GrantedAccess Flags On LSASS

Severity: medium
Author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community
Source: upstream

Detects process access requests to LSASS process with potentially suspicious access flags

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Event coverage

Provider	Event ID	Title
Sysmon	10	ProcessAccess

Stages and Predicates

Stage 1: `all of selection_target`

TargetImage|endswith: '\lsass.exe'

Stage 2: `all of selection_access`

or:
GrantedAccess|endswith: 0x14C2
GrantedAccess|endswith: 18
GrantedAccess|endswith: 1A
GrantedAccess|endswith: 30
GrantedAccess|endswith: 38
GrantedAccess|endswith: 3A
GrantedAccess|endswith: 50
GrantedAccess|endswith: 58
GrantedAccess|endswith: 5A
GrantedAccess|endswith: 70
GrantedAccess|endswith: 78
GrantedAccess|endswith: 7A
GrantedAccess|endswith: 90
GrantedAccess|endswith: 98
GrantedAccess|endswith: 9A
GrantedAccess|endswith: B0
GrantedAccess|endswith: B8
GrantedAccess|endswith: BA
GrantedAccess|endswith: D0
GrantedAccess|endswith: D8
GrantedAccess|endswith: DA
GrantedAccess|endswith: F0
GrantedAccess|endswith: F8
GrantedAccess|endswith: FA
GrantedAccess|startswith: 0x100000
GrantedAccess|startswith: 0x1418
GrantedAccess|startswith: 0x1438
GrantedAccess|startswith: 0x143a
GrantedAccess|startswith: 0x1f0fff
GrantedAccess|startswith: 0x1f1fff
GrantedAccess|startswith: 0x1f2fff
GrantedAccess|startswith: 0x1f3fff
GrantedAccess|startswith: 0x40

Stage 3: `not 1 of filter_main_*`

or:
CallTrace|contains: '|?:\ProgramData\Microsoft\Windows Defender\Definition Updates\{'
CallTrace|contains: '}\mpengine.dll+'
GrantedAccess: 0x1418
GrantedAccess: 0x401
SourceImage|endswith: '\explorer.exe'
SourceImage|endswith: '\MsMpEng.exe'
SourceImage|contains: ':\ProgramData\Microsoft\Windows Defender\'
CallTrace|contains: '|c:\program files\windows defender\MpClient.dll'
CallTrace|contains: '|c:\program files\windows defender\mprtp.dll'
SourceImage|contains: ':\Program Files (x86)\'
SourceImage|contains: ':\Program Files\'
SourceImage|contains: ':\Windows\SysWOW64\'
SourceImage|contains: ':\Windows\System32\'

Stage 4: `not 1 of filter_optional_*`

or:
or:
SourceImage|endswith: '\PROCEXP.EXE'
SourceImage|endswith: '\PROCEXP64.EXE'
GrantedAccess: 0x40
or:
SourceImage|endswith: '\aurora-agent-64.exe'
SourceImage|endswith: '\aurora-agent.exe'
SourceImage|endswith: '\thor.exe'
SourceImage|endswith: '\thor64.exe'
GrantedAccess: 0x40
or:
SourceImage|endswith: '\handle.exe'
SourceImage|endswith: '\handle64.exe'
GrantedAccess: 0x40
GrantedAccess: 0x40
SourceImage|endswith: '\MBAMInstallerService.exe'
GrantedAccess: 0x401
SourceImage|endswith: '\AppData\Local\WebEx\WebexHost.exe'
SourceImage|endswith: '\vmtoolsd.exe'
SourceImage|contains: ':\ProgramData\VMware\VMware Tools\'
SourceImage|endswith: ':\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe'
SourceImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
SourceImage|contains: '\SteamLibrary\steamapps\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CallTrace`	match	`\|?:\ProgramData\Microsoft\Windows Defender\Definition Updates\{` `\|c:\program files\windows defender\MpClient.dll` `\|c:\program files\windows defender\mprtp.dll` `}\mpengine.dll+`
`GrantedAccess`	ends_with	`0x14C2` corpus 3 (sigma 3) `18` corpus 3 (sigma 3) `1A` corpus 3 (sigma 3) `30` corpus 3 (sigma 3) `38` corpus 3 (sigma 3) `3A` corpus 3 (sigma 3) `50` corpus 3 (sigma 3) `58` corpus 3 (sigma 3) `5A` corpus 3 (sigma 3) `70` corpus 3 (sigma 3) `78` corpus 3 (sigma 3) `7A` corpus 3 (sigma 3) `90` corpus 3 (sigma 3) `98` corpus 3 (sigma 3) `9A` corpus 3 (sigma 3) `B0` corpus 3 (sigma 3) `B8` corpus 3 (sigma 3) `BA` corpus 3 (sigma 3) `D0` corpus 3 (sigma 3) `D8` corpus 3 (sigma 3) `DA` corpus 3 (sigma 3) `F0` corpus 3 (sigma 3) `F8` corpus 3 (sigma 3) `FA` corpus 3 (sigma 3)
`GrantedAccess`	eq	`0x1418` `0x40` corpus 2 (sigma 1, elastic 1) `0x401`
`GrantedAccess`	starts_with	`0x100000` `0x1418` `0x1438` `0x143a` `0x1f0fff` `0x1f1fff` `0x1f2fff` `0x1f3fff` `0x40`
`SourceImage`	ends_with	`:\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe` `\AppData\Local\Programs\Microsoft VS Code\Code.exe` corpus 2 (sigma 2) `\AppData\Local\WebEx\WebexHost.exe` corpus 2 (sigma 2) `\MBAMInstallerService.exe` corpus 2 (sigma 2) `\MsMpEng.exe` corpus 13 (sigma 13) `\PROCEXP.EXE` `\PROCEXP64.EXE` `\aurora-agent-64.exe` corpus 2 (sigma 2) `\aurora-agent.exe` corpus 2 (sigma 2) `\explorer.exe` corpus 12 (sigma 12) `\handle.exe` corpus 5 (sigma 5) `\handle64.exe` corpus 5 (sigma 5) `\thor.exe` corpus 7 (sigma 7) `\thor64.exe` corpus 6 (sigma 6) `\vmtoolsd.exe`
`SourceImage`	match	`:\Program Files (x86)\` corpus 4 (sigma 4) `:\Program Files\` corpus 6 (sigma 6) `:\ProgramData\Microsoft\Windows Defender\` `:\ProgramData\VMware\VMware Tools\` `:\Windows\SysWOW64\` corpus 7 (sigma 7) `:\Windows\System32\` corpus 6 (sigma 6) `\SteamLibrary\steamapps\`
`TargetImage`	ends_with	`\lsass.exe` corpus 13 (sigma 13)

Neighbors

Stricter alternatives (narrower than this rule)

The rules below may be useful if you find the current rule is too noisy / lacks specificity.

Credential Dumping Activity By Python Based Tool [sigma] (adds 5 filters) (first-stage match only; downstream stages may differ)
HackTool - HandleKatz Duplicating LSASS Handle [sigma] (adds 4 filters) (first-stage match only; downstream stages may differ)
Suspicious LSASS Access Via MalSecLogon [sigma] (adds 3 filters) (first-stage match only; downstream stages may differ)
Lsass Memory Dump via Comsvcs DLL [sigma] (adds 2 filters) (first-stage match only; downstream stages may differ)
LSASS Memory Access by Tool With Dump Keyword In Name [sigma] (adds 2 filters) (first-stage match only; downstream stages may differ)
Potential Credential Dumping Activity Via LSASS [sigma] (adds 2 filters) (first-stage match only; downstream stages may differ)
Credential Dumping Attempt Via WerFault [sigma] (adds 2 filters) (first-stage match only; downstream stages may differ)
LSASS Access From Potentially White-Listed Processes [sigma] (adds 2 filters) (first-stage match only; downstream stages may differ)
Remote LSASS Process Access Through Windows Remote Management [sigma] (adds 1 filter) (first-stage match only; downstream stages may differ)
Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs [sigma] (adds 1 filter) (first-stage match only; downstream stages may differ)