SignalHunt
← All rules

SYS-4006

critical

LSASS Accessed with Credential-Dumping Rights

Detects a process opening a handle to lsass.exe with the access mask used to read its memory (0x1010 = PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_VM_READ). LSASS holds the credential material for every active session, so reading its memory is the single most direct route from one compromised host to the rest of the domain. A CallTrace of UNKNOWN alongside this is a strong sign of injected or unbacked code doing the reading.

T1003.001
Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `EventID` is 10 AND `TargetImage` ends with "lsass.exe" AND `GrantedAccess` is "0x1010" or "0x1410" or "0x1438" or "0x143a".

{
  "detection_type": "selection",
  "selection": {
    "EventID": 10,
    "TargetImage|endswith": "lsass.exe",
    "GrantedAccess": [
      "0x1010",
      "0x1410",
      "0x1438",
      "0x143a"
    ]
  }
}

Log source: product=windows, service=sysmon · Event ID(s): 10

Required log fields

  • SourceImage
  • TargetImage
  • GrantedAccess
  • CallTrace

Enabling this in your environment

Where: Sysmon configuration - ProcessAccess (Event ID 10) enabled with TargetImage scoped to lsass.exe. It is excluded in many default configs because unscoped ProcessAccess is extremely high volume. 

sysmon64.exe -c sysmonconfig.xml

Scope ProcessAccess to lsass.exe or this event will overwhelm the pipeline. Filter on GrantedAccess rather than SourceImage: attackers rename their tooling freely, but the access mask needed to read process memory is fixed by the API.

Seen in incidents

False positives

  • EDR, AV and some backup agents legitimately read LSASS - build an allow-list by SourceImage and signature, not by access mask
  • Windows Defender and MsMpEng touch LSASS during scans

References