Suspicious Child Process for lsass.exe (Sysmon)

id: '19108.32982'
title: Suspicious Child Process for lsass.exe
description: 'This use case detects when the Local Security Authority Subsystem Service
  (lsass.exe) spawns a child process. This can indicate process injection/hollowing,
  masquerading, or other suspicious activity. Normal activity for lsass.exe does not
  typically include spawning child processes, with the exception of EFS (Encrypting
  File System). Atomics T1134.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(lsass) OR "lsass.exe" | regex parent_process_name="(?i)lsass\.exe" | table
  _time, host, user process, process_*, parent_process_name, parent_process_* | bin
  span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:process injection
technique_id:
- T1036.004
- T1055
data_category:
- Windows Sysmon
references:
- https://andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/