Query: Sigma rule for Detects process handle on LSASS process with certain access mask
Matching passage: Sigma rule: Detects process handle on LSASS process with certain access mask. Logsource: windows / security. Rule: title: Potentially Suspicious AccessMask Requested From LSASS id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76 status: test description: Detects process handle on LSASS process with certain access mask references: - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) date: 2019-11-01 modified: 2026-06-29 tags: - attack.credential-access - car.2019-04-004 - attack.t1003.001 logsource: product: windows service: security detection: selection_1: EventID: 4656 ObjectName|endswith: \lsass.exe AccessMask|contains: - '0x40' - '0x1400' - '0x100000' - '0x1410' - '0x1010' - '0x1438' - '0x143a' - '0x1418' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' selection_2: EventID: 4663 ObjectName|endswith: \lsass.exe AccessList|contains: - '4484' - '4416' filter_main_specific: ProcessName|endswith: - \csrss.exe - \GamingServices.exe - \lsm.exe - \MicrosoftEdgeUpdate.exe - \minionhost.exe - \MRT.exe - \MsMpEng.exe - \perfmon.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \svchost.exe - \taskmgr.exe - \thor.exe - \thor64.exe - \vmtoolsd.exe - \VsTskMgr.exe - \wininit.exe - \wmiprvse.exe - RtkAudUService64 ProcessName|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\Microsoft\Windows Defender\Platform\ - :\Windows\SysNative\ - :\Windows\System32\ - :\Windows\SysWow64\ - :\Windows\Temp\asgard2-agent\ filter_main_generic: ProcessName|contains: :\Program Files filter_main_exact: ProcessName|endswith: - :\Windows\System32\taskhostw.exe - :\Windows\System32\msiexec.exe - :\Windows\CCM\CcmExec.exe filter_main_sysmon: ProcessName|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe AccessList|contains: '%%4484' filter_main_aurora: ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\ ProcessName|endswith: \aurora-agent-64.exe AccessList|contains: '%%4484' filter_main_scenarioengine: ProcessName|endswith: \x64\SCENARIOENGINE.EXE AccessList|contains: '%%4484' filter_main_avira1: ProcessName|contains|all: - :\Users\ - \AppData\Local\Temp\is- ProcessName|endswith: \avira_system_speedup.tmp AccessList|contains: '%%4484' filter_main_avira2: ProcessName|contains: :\Windows\Temp\ ProcessName|endswith: \avira_speedup_setup_update.tmp AccessList|contains:
Near-miss passage: Sigma rule: Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) co. Logsource: windows / process_creation. Rule: title: MSHTA Execution with Suspicious File Extensions id: cc7abbd0-762b-41e3-8a26-57ad50d2eea3 status: test description: 'Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection. ' references: - http://blog.sevagas.com/?Hacking-around-HTA-files - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356 - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997 - https://twitter.com/mattifestation/status/1326228491302563846 - https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-02-22 modified: 2025-05-12 tags: - attack.stealth - attack.t1140 - attack.t1218.005 - attack.execution - attack.t1059.007 - cve.2020-1599 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: mshta.exe selection_cli: CommandLine|contains: - .7z - .avi - .bat - .bmp - .conf - .csv - .dll - .doc - .gif - .gz - .ini - .jpe - .jpg - .json - .lnk - .log - .mkv - .mp3 - .mp4 - .pdf - .png - .ppt - .rar - .rtf - .svg - .tar - .tmp - .txt - .xls - .xml - .yaml - .yml - .zip - vbscript condition: all of selection_* falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high