Remote LSASS Process Access Through Windows Remote Management

Status: stable
Severity: high
Log source: category process_access, product windows
Author: Patryk Prauze - ING Tech
Source: github.com/SigmaHQ/sigma

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory
Lateral Movement	`T1021.006` Remote Services: Windows Remote Management

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 10: ProcessAccess

Rule body

title: Remote LSASS Process Access Through Windows Remote Management
id: aa35a627-33fb-4d04-a165-d33b4afca3e8
status: stable
description: Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
references:
    - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
author: Patryk Prauze - ING Tech
date: 2019-05-20
modified: 2023-11-29
tags:
    - attack.credential-access
    - attack.execution
    - attack.t1003.001
    - attack.t1059.001
    - attack.lateral-movement
    - attack.t1021.006
    - attack.s0002
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        SourceImage|endswith: ':\Windows\system32\wsmprovhost.exe'
    filter_main_access:
        GrantedAccess: '0x80000000'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetImage|endswith: '\lsass.exe'
    SourceImage|endswith: ':\Windows\system32\wsmprovhost.exe'

Stage 2: `not filter_main_access`

filter_main_access:
    GrantedAccess: '0x80000000'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`GrantedAccess`	eq	`0x80000000`	`excludes:GrantedAccess` `field:"GrantedAccess" value:"0x80000000"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SourceImage`	ends_with	`:\Windows\system32\wsmprovhost.exe`	`field:"SourceImage" kind:ends_with value:":\Windows\system32\wsmprovhost.exe"`
`TargetImage`	ends_with	`\lsass.exe` corpus 16 (sigma 16)	`field:"TargetImage" kind:ends_with value:"\lsass.exe"`