Potentially Suspicious AccessMask Requested From LSASS

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•1•0•29

Detects attempts to access the Local Security Authority Subsystem Service (LSASS) process with suspicious access masks. Adversaries often target LSASS to dump credentials for lateral movement or privilege escalation. The rule looks for specific access mask values in Windows Security Event IDs 4656 (handle requested) and 4663 (object access attempt) that are indicative of credential dumping activities, while filtering out known legitimate processes.