LSASS named pipe access
A connection was made to the \lsass named pipe.
What it detects
A connection was made to the \lsass named pipe. LSASS holds the credential material of every account currently or recently logged on, and its pipe is the interface remote tooling uses to talk to it without opening the process directly — which is what a rule watching for OpenProcess on lsass.exe looks for and misses.
Sysmon 18 (ConnectPipe) with Image=System means the connection arrived over SMB from another host, so this is the target-side record of remote credential interaction. It is the pipe-level companion to windows.credential.lsass_access (process handle) and windows.credential.lsass_object_access (Security-log SACL): three views of the same asset, because in practice an estate has only one of the three collected.
MITRE ATT&CK mapping
False positives and triage
Some legitimate remote administration and endpoint-security tooling touches this pipe, and domain controllers see more of it than workstations by nature.
To confirm: establish which host initiated the SMB session at that moment — the pipe event names the local process (System), not the remote caller, so the answer is in the matching 5145 or the network session, not in this event. A connection from a workstation rather than a management server is the finding. Check for other pipes from the same source in the same window: an operator enumerating \lsass usually also touches \samr or \lsarpc.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/lsass_named_pipe_access.yaml, licensed under the Apache License 2.0.
id: windows.credential.lsass_named_pipe_access
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1003, T1021.002]
description: |
A connection was made to the `\lsass` named pipe. LSASS holds the credential
material of every account currently or recently logged on, and its pipe is the
interface remote tooling uses to talk to it without opening the process directly —
which is what a rule watching for `OpenProcess` on lsass.exe looks for and misses.
Sysmon 18 (`ConnectPipe`) with `Image=System` means the connection arrived over
SMB from another host, so this is the target-side record of remote credential
interaction. It is the pipe-level companion to
`windows.credential.lsass_access` (process handle) and
`windows.credential.lsass_object_access` (Security-log SACL): three views of the
same asset, because in practice an estate has only one of the three collected.
match:
event_action: named_pipe
file_path_contains_any:
- '\lsass'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Some legitimate remote administration and endpoint-security tooling touches this
pipe, and domain controllers see more of it than workstations by nature.
To confirm: establish which host initiated the SMB session at that moment — the
pipe event names the local process (`System`), not the remote caller, so the
answer is in the matching 5145 or the network session, not in this event. A
connection from a workstation rather than a management server is the finding.
Check for other pipes from the same source in the same window: an operator
enumerating `\lsass` usually also touches `\samr` or `\lsarpc`.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.