Uncommon Process Accessing LSASS Memory

Francesco Bocchi@fra_

•updated Jul 7, 2026•14•0•31

This rule monitors for processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS) with permissions (PROCESS_VM_READ and PROCESS_QUERY_INFORMATION) typically required for credential dumping. It filters out processes that have historically performed this action in the last 30 days to reduce noise and highlight potentially malicious or anomalous activity.