Unsigned Image Loaded Into LSASS Process

Title: Unsigned Image Loaded Into LSASS Process
Status: test
Description:Loading unsigned image (DLL, EXE) into LSASS process
References:
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith: '\lsass.exe'
    Signed: 'false'
  condition:selection
Falsepositives:
  -Valid user connecting using RDP
Level: medium