LSASS access
A process opened a handle to lsass.exe with credential-read access rights (Sysmon ProcessAccess, Event ID 10, TargetImage lsass.exe with a GrantedAccess…
What it detects
A process opened a handle to lsass.exe with credential-read access rights (Sysmon ProcessAccess, Event ID 10, TargetImage lsass.exe with a GrantedAccess mask used to read process memory — 0x1010 / 0x1410 / 0x1438 / 0x143a / 0x1418 / 0x1428). This is the PRIMITIVE behind LSASS credential theft: Mimikatz and direct-API dumpers read LSASS memory without ever touching a known dumping command line, so they slip past windows.credential.lsass_dump (which keys on comsvcs/procdump/nanodump command lines). Watching the handle-open with credential-read rights catches the technique regardless of tool. Realises a catalogued behaviour (process-memory dumping activity).
MITRE ATT&CK mapping
- T1003.001OS Credential Dumping: LSASS Memory· Credential Access
False positives and triage
Some legitimate software touches LSASS with high access rights — EDR/AV agents, certain backup/credential-manager and system processes. The strong signal is an UNEXPECTED SourceImage (an Office child, a script host, a tool in a user-writable path, an unsigned binary) opening lsass with these masks. Confirm the accessing process, its parent, and its signature; maintain an allow-list of your endpoint agent's SourceImage to suppress it.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/windows/lsass_access.yaml, licensed under the Apache License 2.0.
id: windows.credential.lsass_access
version: 1.0.0
status: stable
severity: critical
confidence: 0.75
platforms: [windows]
mitre_techniques: [T1003.001]
description: |
A process opened a handle to lsass.exe with credential-read access rights (Sysmon
ProcessAccess, Event ID 10, TargetImage lsass.exe with a GrantedAccess mask used to read
process memory — 0x1010 / 0x1410 / 0x1438 / 0x143a / 0x1418 / 0x1428). This is the
PRIMITIVE behind LSASS credential theft: Mimikatz and direct-API dumpers read LSASS memory
without ever touching a known dumping command line, so they slip past
windows.credential.lsass_dump (which keys on comsvcs/procdump/nanodump command lines).
Watching the handle-open with credential-read rights catches the technique regardless of
tool. Realises behavioural catalog BEH-071 (process-memory dumping activity).
match:
event_action: process_access
file_path_contains_any:
- "lsass.exe"
raw_message_contains_any:
- "0x1010"
- "0x1410"
- "0x1438"
- "0x143a"
- "0x1418"
- "0x1428"
false_positive_guidance: |
Some legitimate software touches LSASS with high access rights — EDR/AV agents, certain
backup/credential-manager and system processes. The strong signal is an UNEXPECTED
SourceImage (an Office child, a script host, a tool in a user-writable path, an unsigned
binary) opening lsass with these masks. Confirm the accessing process, its parent, and its
signature; maintain an allow-list of your endpoint agent's SourceImage to suppress it.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.