Potentially Suspicious AccessMask Requested From LSASS

Title: Potentially Suspicious AccessMask Requested From LSASS
Status: test
Description:Detects process handle on LSASS process with certain access mask
References:
  -https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)
Date: 2019-11-01
modified:2026-06-29
Tags:

• -'attack.credential-access'
• -'car.2019-04-004'
• -'attack.t1003.001'

Logsource:

• product: windows
• service: security

Detection:
  selection_1:
    EventID: '4656'
    ObjectName|endswith: '\lsass.exe'
    AccessMask|contains:
      -'0x40'
      -'0x1400'
      -'0x100000'
      -'0x1410'
      -'0x1010'
      -'0x1438'
      -'0x143a'
      -'0x1418'
      -'0x1f0fff'
      -'0x1f1fff'
      -'0x1f2fff'
      -'0x1f3fff'

  selection_2:
    EventID: '4663'
    ObjectName|endswith: '\lsass.exe'
    AccessList|contains:
      -'4484'
      -'4416'

  filter_main_specific:
    ProcessName|endswith:
      -'\csrss.exe'
      -'\GamingServices.exe'
      -'\lsm.exe'
      -'\MicrosoftEdgeUpdate.exe'
      -'\minionhost.exe'
      -'\MRT.exe'
      -'\MsMpEng.exe'
      -'\perfmon.exe'
      -'\procexp.exe'
      -'\procexp64.exe'
      -'\procexp64a.exe'
      -'\svchost.exe'
      -'\taskmgr.exe'
      -'\thor.exe'
      -'\thor64.exe'
      -'\vmtoolsd.exe'
      -'\VsTskMgr.exe'
      -'\wininit.exe'
      -'\wmiprvse.exe'
      -'RtkAudUService64'

    ProcessName|contains:
      -':\Program Files (x86)\'
      -':\Program Files\'
      -':\ProgramData\Microsoft\Windows Defender\Platform\'
      -':\Windows\SysNative\'
      -':\Windows\System32\'
      -':\Windows\SysWow64\'
      -':\Windows\Temp\asgard2-agent\'

  filter_main_generic:
    ProcessName|contains: ':\Program Files'
  filter_main_exact:
    ProcessName|endswith:
      -':\Windows\System32\taskhostw.exe'
      -':\Windows\System32\msiexec.exe'
      -':\Windows\CCM\CcmExec.exe'

  filter_main_sysmon:
    ProcessName|endswith:
      -':\Windows\Sysmon64.exe'
      -':\Windows\Sysmon64a.exe'

    AccessList|contains: '%%4484'
  filter_main_aurora:
    ProcessName|contains: ':\Windows\Temp\asgard2-agent-sc\aurora\'
    ProcessName|endswith: '\aurora-agent-64.exe'
    AccessList|contains: '%%4484'
  filter_main_scenarioengine:
    ProcessName|endswith: '\x64\SCENARIOENGINE.EXE'
    AccessList|contains: '%%4484'
  filter_main_avira1:
    ProcessName|contains|all:
      -':\Users\'
      -'\AppData\Local\Temp\is-'

    ProcessName|endswith: '\avira_system_speedup.tmp'
    AccessList|contains: '%%4484'
  filter_main_avira2:
    ProcessName|contains: ':\Windows\Temp\'
    ProcessName|endswith: '\avira_speedup_setup_update.tmp'
    AccessList|contains: '%%4484'
  filter_main_snmp:
    ProcessName|endswith: ':\Windows\System32\snmp.exe'
    AccessList|contains: '%%4484'
  filter_main_googleupdate:
    ProcessName|contains: ':\Windows\SystemTemp\'
    ProcessName|endswith: '\GoogleUpdate.exe'
    AccessList|contains: '%%4484'
  filter_optional_procmon:
    ProcessName|endswith:
      -'\procmon64.exe'
      -'\procmon64a.exe'
      -'\procmon.exe'

    AccessList|contains: '%%4484'
  condition:1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it
Level: medium