Uncommon GrantedAccess Flags On LSASS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific uncommon access flags (0x410 and 0x01410). These flags are often used by tools or techniques designed to dump credentials from LSASS, a common method for credential theft on Windows systems. The rule includes extensive filters to reduce false positives from legitimate software that might interact with LSASS.