LSASS Memory Access

Use case development / Detect Unauthorized Access / Detect Credential Theft

sigma

Detection rule

title: LSASS Memory Access Detection
status: experimental
description: Detects processes accessing LSASS memory indicating credential dumping
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1038'
      - '0x143a'
  filter:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\csrss.exe'
  condition: selection and not filter
falsepositives:
  - Security tools
level: critical
tags:
  - attack.credential_access
  - attack.t1003

Test cases

• Run Mimikatz sekurlsa::logonpasswords

False positive guidance

Whitelist legitimate security tools accessing LSASS.

Detection course