Suspicious LSASS Access Via MalSecLogon

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.