Query: alert when Detects process handle on LSASS process with certain access mask
Matching passage: Sigma rule: Detects process handle on LSASS process with certain access mask. Logsource: windows / security. Rule: title: Potentially Suspicious AccessMask Requested From LSASS id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76 status: test description: Detects process handle on LSASS process with certain access mask references: - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) date: 2019-11-01 modified: 2026-06-29 tags: - attack.credential-access - car.2019-04-004 - attack.t1003.001 logsource: product: windows service: security detection: selection_1: EventID: 4656 ObjectName|endswith: \lsass.exe AccessMask|contains: - '0x40' - '0x1400' - '0x100000' - '0x1410' - '0x1010' - '0x1438' - '0x143a' - '0x1418' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' selection_2: EventID: 4663 ObjectName|endswith: \lsass.exe AccessList|contains: - '4484' - '4416' filter_main_specific: ProcessName|endswith: - \csrss.exe - \GamingServices.exe - \lsm.exe - \MicrosoftEdgeUpdate.exe - \minionhost.exe - \MRT.exe - \MsMpEng.exe - \perfmon.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \svchost.exe - \taskmgr.exe - \thor.exe - \thor64.exe - \vmtoolsd.exe - \VsTskMgr.exe - \wininit.exe - \wmiprvse.exe - RtkAudUService64 ProcessName|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\Microsoft\Windows Defender\Platform\ - :\Windows\SysNative\ - :\Windows\System32\ - :\Windows\SysWow64\ - :\Windows\Temp\asgard2-agent\ filter_main_generic: ProcessName|contains: :\Program Files filter_main_exact: ProcessName|endswith: - :\Windows\System32\taskhostw.exe - :\Windows\System32\msiexec.exe - :\Windows\CCM\CcmExec.exe filter_main_sysmon: ProcessName|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe AccessList|contains: '%%4484' filter_main_aurora: ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\ ProcessName|endswith: \aurora-agent-64.exe AccessList|contains: '%%4484' filter_main_scenarioengine: ProcessName|endswith: \x64\SCENARIOENGINE.EXE AccessList|contains: '%%4484' filter_main_avira1: ProcessName|contains|all: - :\Users\ - \AppData\Local\Temp\is- ProcessName|endswith: \avira_system_speedup.tmp AccessList|contains: '%%4484' filter_main_avira2: ProcessName|contains: :\Windows\Temp\ ProcessName|endswith: \avira_speedup_setup_update.tmp AccessList|contains:
Near-miss passage: Sigma rule: Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential. Logsource: linux / process_creation. Rule: title: Python Spawning Pretty TTY Via PTY Module id: c4042d54-110d-45dd-a0e1-05c47822c937 related: - id: 32e62bc7-3de0-4bb1-90af-532978fe42c0 type: similar status: test description: 'Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity. ' references: - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ author: Nextron Systems date: 2022-06-03 modified: 2024-11-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_cli_import: CommandLine|contains: - import pty - 'from pty ' selection_cli_spawn: CommandLine|contains: spawn condition: all of selection_* falsepositives: - Unknown level: medium