Query: detection rule: Detects process handle on LSASS process with certain access mask
Matching passage: Sigma rule: Detects process handle on LSASS process with certain access mask. Logsource: windows / security. Rule: title: Potentially Suspicious AccessMask Requested From LSASS id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76 status: test description: Detects process handle on LSASS process with certain access mask references: - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) date: 2019-11-01 modified: 2026-06-29 tags: - attack.credential-access - car.2019-04-004 - attack.t1003.001 logsource: product: windows service: security detection: selection_1: EventID: 4656 ObjectName|endswith: \lsass.exe AccessMask|contains: - '0x40' - '0x1400' - '0x100000' - '0x1410' - '0x1010' - '0x1438' - '0x143a' - '0x1418' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' selection_2: EventID: 4663 ObjectName|endswith: \lsass.exe AccessList|contains: - '4484' - '4416' filter_main_specific: ProcessName|endswith: - \csrss.exe - \GamingServices.exe - \lsm.exe - \MicrosoftEdgeUpdate.exe - \minionhost.exe - \MRT.exe - \MsMpEng.exe - \perfmon.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \svchost.exe - \taskmgr.exe - \thor.exe - \thor64.exe - \vmtoolsd.exe - \VsTskMgr.exe - \wininit.exe - \wmiprvse.exe - RtkAudUService64 ProcessName|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\Microsoft\Windows Defender\Platform\ - :\Windows\SysNative\ - :\Windows\System32\ - :\Windows\SysWow64\ - :\Windows\Temp\asgard2-agent\ filter_main_generic: ProcessName|contains: :\Program Files filter_main_exact: ProcessName|endswith: - :\Windows\System32\taskhostw.exe - :\Windows\System32\msiexec.exe - :\Windows\CCM\CcmExec.exe filter_main_sysmon: ProcessName|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe AccessList|contains: '%%4484' filter_main_aurora: ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\ ProcessName|endswith: \aurora-agent-64.exe AccessList|contains: '%%4484' filter_main_scenarioengine: ProcessName|endswith: \x64\SCENARIOENGINE.EXE AccessList|contains: '%%4484' filter_main_avira1: ProcessName|contains|all: - :\Users\ - \AppData\Local\Temp\is- ProcessName|endswith: \avira_system_speedup.tmp AccessList|contains: '%%4484' filter_main_avira2: ProcessName|contains: :\Windows\Temp\ ProcessName|endswith: \avira_speedup_setup_update.tmp AccessList|contains:
Near-miss passage: Sigma rule: Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmuti. Logsource: macos / process_creation. Rule: title: Time Machine Backup Disabled Via Tmutil - MacOS id: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da status: test description: 'Detects disabling of Time Machine (Apple''s automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine - https://www.loobins.io/binaries/tmutil/ author: Pratinav Chandra date: 2024-05-29 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: macos detection: selection_img: - Image|endswith: /tmutil - CommandLine|contains: tmutil selection_cmd: CommandLine|contains: disable condition: all of selection_* falsepositives: - Legitimate administrator activity level: medium