Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is. Logsource: windows / process_access. Rule: title: Potential Credential Dumping Activity Via LSASS id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da status: test description: 'Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. ' references: - https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md - https://research.splunk.com/endpoint/windows_possible_credential_dumping/ author: Samir Bousseaden, Michael Haag date: 2019-04-03 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess|contains: - '0x1038' - '0x1438' - '0x143a' - '0x1fffff' CallTrace|contains: - dbgcore.dll - dbghelp.dll - kernel32.dll - kernelbase.dll - ntdll.dll filter_main_system_user: SourceUser|contains: - AUTHORI - AUTORI filter_optional_thor: CallTrace|contains|all: - :\Windows\Temp\asgard2-agent\ - \thor\thor64.exe+ - '|UNKNOWN(' GrantedAccess: '0x103800' filter_optional_sysmon: SourceImage|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a fil. Logsource: windows / appxdeployment-server. Rule: title: Remote AppX Package Downloaded from File Sharing or CDN Domain id: 8b48ad89-10d8-4382-a546-50588c410f0d related: - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2026-03-29 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 854 Path|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at condition: selection falsepositives: - Unlikely, unless the organization uses file sharing or CDN services to distribute internal applications. level: high