LSASS Access From Non-System Account

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•23

Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory from non-system accounts, which is a common technique used by credential dumping tools like Mimikatz. The rule specifically looks for security events (4663 or 4656) related to process object access with specific access masks targeting 'lsass.exe', while filtering out legitimate system accounts and known benign processes.