Potentially Suspicious AccessMask Requested From LSASS

  1title: Potentially Suspicious AccessMask Requested From LSASS
  2id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76
  3status: test
  4description: Detects process handle on LSASS process with certain access mask
  5references:
  6    - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  7    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  8author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)
  9date: 2019-11-01
 10modified: 2026-06-29
 11tags:
 12    - attack.credential-access
 13    - car.2019-04-004
 14    - attack.t1003.001
 15logsource:
 16    product: windows
 17    service: security
 18detection:
 19    selection_1:
 20        EventID: 4656 # A handle to an object was requested.
 21        ObjectName|endswith: '\lsass.exe'
 22        AccessMask|contains:
 23            - '0x40'
 24            - '0x1400'
 25            # - '0x1000'  # minimum access requirements to query basic info from service
 26            - '0x100000'
 27            - '0x1410'    # car.2019-04-004
 28            - '0x1010'    # car.2019-04-004
 29            - '0x1438'    # car.2019-04-004
 30            - '0x143a'    # car.2019-04-004
 31            - '0x1418'    # car.2019-04-004
 32            - '0x1f0fff'
 33            - '0x1f1fff'
 34            - '0x1f2fff'
 35            - '0x1f3fff'
 36    selection_2:
 37        EventID: 4663 # An attempt was made to access an object
 38        ObjectName|endswith: '\lsass.exe'
 39        AccessList|contains:
 40            - '4484'
 41            - '4416'
 42    filter_main_specific:
 43        ProcessName|endswith:
 44            - '\csrss.exe'
 45            - '\GamingServices.exe'
 46            - '\lsm.exe'
 47            - '\MicrosoftEdgeUpdate.exe'
 48            - '\minionhost.exe'  # Cyberreason
 49            - '\MRT.exe'         # MS Malware Removal Tool
 50            - '\MsMpEng.exe'     # Defender
 51            - '\perfmon.exe'
 52            - '\procexp.exe'
 53            - '\procexp64.exe'
 54            - '\procexp64a.exe'
 55            - '\svchost.exe'
 56            - '\taskmgr.exe'
 57            - '\thor.exe'        # THOR
 58            - '\thor64.exe'      # THOR
 59            - '\vmtoolsd.exe'
 60            - '\VsTskMgr.exe'    # McAfee Enterprise
 61            - '\wininit.exe'
 62            - '\wmiprvse.exe'
 63            - 'RtkAudUService64' # https://medium.com/falconforce/the-curious-case-of-realtek-and-lsass-33fc0c8482ff
 64        ProcessName|contains:
 65            - ':\Program Files (x86)\'
 66            - ':\Program Files\'
 67            - ':\ProgramData\Microsoft\Windows Defender\Platform\'
 68            - ':\Windows\SysNative\'
 69            - ':\Windows\System32\'
 70            - ':\Windows\SysWow64\'
 71            - ':\Windows\Temp\asgard2-agent\'
 72    filter_main_generic:
 73        ProcessName|contains: ':\Program Files'  # too many false positives with legitimate AV and EDR solutions
 74    filter_main_exact:
 75        ProcessName|endswith:
 76            - ':\Windows\System32\taskhostw.exe'
 77            - ':\Windows\System32\msiexec.exe'
 78            - ':\Windows\CCM\CcmExec.exe'
 79    filter_main_sysmon:
 80        ProcessName|endswith:
 81            - ':\Windows\Sysmon64.exe'
 82            - ':\Windows\Sysmon64a.exe'
 83        AccessList|contains: '%%4484'
 84    filter_main_aurora:
 85        ProcessName|contains: ':\Windows\Temp\asgard2-agent-sc\aurora\'
 86        ProcessName|endswith: '\aurora-agent-64.exe'
 87        AccessList|contains: '%%4484'
 88    filter_main_scenarioengine:
 89        # Example: C:\a70de9569c3a5aa22184ef52a890177b\x64\SCENARIOENGINE.EXE
 90        ProcessName|endswith: '\x64\SCENARIOENGINE.EXE'
 91        AccessList|contains: '%%4484'
 92    filter_main_avira1:
 93        ProcessName|contains|all:
 94            - ':\Users\'
 95            - '\AppData\Local\Temp\is-'
 96        ProcessName|endswith: '\avira_system_speedup.tmp'
 97        AccessList|contains: '%%4484'
 98    filter_main_avira2:
 99        ProcessName|contains: ':\Windows\Temp\'
100        ProcessName|endswith: '\avira_speedup_setup_update.tmp'
101        AccessList|contains: '%%4484'
102    filter_main_snmp:
103        ProcessName|endswith: ':\Windows\System32\snmp.exe'
104        AccessList|contains: '%%4484'
105    filter_main_googleupdate:
106        ProcessName|contains: ':\Windows\SystemTemp\'
107        ProcessName|endswith: '\GoogleUpdate.exe'
108        AccessList|contains: '%%4484'
109    filter_optional_procmon:
110        ProcessName|endswith:
111            - '\procmon64.exe'
112            - '\procmon64a.exe'
113            - '\procmon.exe'
114        AccessList|contains: '%%4484'
115    condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
116falsepositives:
117    - Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it
118level: medium