These artifacts describe access to another process. The rules select source and target images, access values, and call traces.
- Sysmon Event ID 10: ProcessAccess
- Security Event ID 4656: Handle requested
- Security Event ID 4663: Object access right used
Process Access Rights and Targets #
Selected targets and access values in process access records.
- Credential Dumping Activity By Python Based Tool Sigma
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.
- Credential Dumping Attempt Via WerFault Sigma
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.
- HackTool - HandleKatz Duplicating LSASS Handle Sigma
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
- LSASS Access From Potentially White-Listed Processes Sigma
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference
- LSASS Access From Program In Potentially Suspicious Folder Sigma
Detects process access to LSASS memory with suspicious access flags and from a potentially suspicious folder
- LSASS Memory Access by Tool With Dump Keyword In Name Sigma
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
- Lsass Memory Dump via Comsvcs DLL Sigma
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.
- Potential Credential Dumping Activity Via LSASS Sigma
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
- Potential Credential Dumping Attempt Via PowerShell Sigma
Detects a PowerShell process requesting access to "lsass.exe", which can be indicative of potential credential dumping attempts
- Potentially Suspicious GrantedAccess Flags On LSASS Sigma
Detects process access requests to LSASS process with potentially suspicious access flags
- Remote LSASS Process Access Through Windows Remote Management Sigma
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
- Suspicious LSASS Access Via MalSecLogon Sigma
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
- Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs Sigma
Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.
- Uncommon GrantedAccess Flags On LSASS Sigma
Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410
LSASS Access: Call Traces #
Selected LSASS targets with source images and call trace patterns.
- HackTool - HandleKatz Duplicating LSASS Handle Sigma
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
Other Process Access Context #
Process access records with context that does not fit the target, rights, or call trace groups.
- Potential Direct Syscall of NtOpenProcess Sigma
Detects potential calls to NtOpenProcess directly from NTDLL.