Detection rules › Elastic
LSASS Access Attempt from an Unsigned Executable
Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) by an unsigned process that was recently dropped. Adversaries may attempt to access credential material stored in the process memory of LSASS.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Rule body
[rule]
description = """
Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) by an unsigned process that was
recently dropped. Adversaries may attempt to access credential material stored in the process memory of LSASS.
"""
id = "6661d3b1-0baa-413c-9843-d83b8f9baaee"
license = "Elastic License v2"
name = "LSASS Access Attempt from an Unsigned Executable"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth"]
version = "1.0.16"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
(process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
not process.hash.sha256 : "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a"]
[credential_access where
startswith~(process.thread.Ext.call_stack_final_user_module.path, process.executable)]
'''
min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.7.0"
Stages and Predicates
Ordered sequence: each step below must occur in order within 5m, correlated by process.entity_id.
Stage 1: process
[process where event.action == "start" and
(process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
not process.hash.sha256 : "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a"]
Stage 2: credential_access
[credential_access where
startswith~(process.thread.Ext.call_stack_final_user_module.path, process.executable)]
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
process.code_signature.status | wildcard | trusted, errorExpired, errorCode_endpoint* | excludes:process.code_signature.status field:"process.code_signature.status" value:"trusted" field:"process.code_signature.status" value:"errorExpired" field:"process.code_signature.status" value:"errorCode_endpoint*" |
process.hash.sha256 | eq | 1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a | excludes:process.hash.sha256 field:"process.hash.sha256" value:"1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a" |
Indicators
These rows show field, operator, and value matches.