Suspicious LSASS Process Access with PROCESS_VM_READ from Non-Standard Path
This rule detects unauthorized processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights. Such access is often associated with credential dumping techniques, particularly those utilizing direct syscalls to evade EDR and kernel-level monitoring by bypassing standard Windows API-based detection mechanisms.
Sigma
