Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects process access requests to LSASS process with potentially suspicious access flags. Logsource: windows / process_access. Rule: title: Potentially Suspicious GrantedAccess Flags On LSASS id: a18dd26b-6450-46de-8c91-9659150cf088 related: - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d type: similar status: test description: Detects process access requests to LSASS process with potentially suspicious access flags references: - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community date: 2021-11-22 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection_target: TargetImage|endswith: \lsass.exe selection_access: - GrantedAccess|endswith: - '30' - '50' - '70' - '90' - B0 - D0 - F0 - '18' - '38' - '58' - '78' - '98' - B8 - D8 - F8 - 1A - 3A - 5A - 7A - 9A - BA - DA - FA - '0x14C2' - GrantedAccess|startswith: - '0x100000' - '0x1418' - '0x1438' - '0x143a' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' - '0x40' filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ filter_optional_malwarebytes: SourceImage|endswith: :\ProgramData\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe filter_optional_vscode: SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe filter_main_windefend_1: SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\ SourceImage|endswith: \MsMpEng.exe filter_main_windefend_2: CallTrace|contains|all: - '|?:\ProgramData\Microsoft\Windows Defender\Definition Updates\{' - '}\mpengine.dll+' GrantedAccess: '0x1418' filter_main_windefend_3: CallTrace|contains: - '|c:\program files\windows defender\mprtp.dll' - '|c:\program files\windows defender\MpClient.dll' filter_optional_vmwaretools: SourceImage|contains: :\ProgramData\VMware\VMware Tools\ SourceImage|endswith: \
Near-miss passage: Sigma rule: Detects potentially highly relevant antivirus events in the application log based on known virus signature names and mal. Logsource: windows / application. Rule: title: Relevant Anti-Virus Signature Keywords In Application Log id: 78bc5783-81d9-4d73-ac97-59f6db4f72a8 status: test description: 'Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords. ' references: - https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31 - https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed - https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01 - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2017-02-19 modified: 2024-12-25 tags: - attack.resource-development - attack.t1588 logsource: product: windows service: application detection: keywords: - Adfind - 'ASP/BackDoor ' - ATK/ - Backdoor.ASP - Backdoor.Cobalt - Backdoor.JSP - Backdoor.PHP - Blackworm - Brutel - BruteR - Chopper - Cobalt - COBEACON - Cometer - CRYPTES - Cryptor - Destructor - DumpCreds - Exploit.Script.CVE - FastReverseProxy - Filecoder - 'GrandCrab ' - HackTool - HKTL - HTool- - /HTool - .HTool - IISExchgSpawnCMD - Impacket - 'JSP/BackDoor ' - Keylogger - Koadic - Krypt - Lazagne - Metasploit - Meterpreter - MeteTool - mikatz - Mimikatz - Mpreter - MsfShell - Nighthawk - Packed.Generic.347 - PentestPowerShell - Phobos - 'PHP/BackDoor ' - Potato - PowerSploit - PowerSSH - PshlSpy - PSWTool - PWCrack - PWDump - Ransom - Rozena - Ryzerlo - Sbelt - Seatbelt - 'SecurityTool ' - SharpDump - Shellcode - Sliver - Splinter - Swrort - Tescrypt - TeslaCrypt - TurtleLoader - Valyria - Webshell filter_optional_generic: - anti_ransomware_service.exe - Anti-Ransomware - Crack - cyber-protect-service.exe - encryptor - Keygen filter_optional_information: Level: 4 filter_optional_restartmanager: Provider_Name: Microsoft-Windows-RestartManager condition: keywords and not 1 of filter_optional_* falsepositives: - Some software piracy tools (key generators, cracks) are classified as hack tools level: high