Unsigned Image Loaded Into LSASS Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects when an unsigned image (DLL or EXE) is loaded into the Local Security Authority Subsystem Service (LSASS) process. Adversaries often inject malicious, unsigned code into LSASS to dump credentials, as LSASS stores sensitive authentication material. Detecting unsigned code in this critical process can indicate an attempt at credential dumping or other forms of privilege escalation.