Query: rule covering Detects process handle on LSASS process with certain access mask
Matching passage: Sigma rule: Detects process handle on LSASS process with certain access mask. Logsource: windows / security. Rule: title: Potentially Suspicious AccessMask Requested From LSASS id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76 status: test description: Detects process handle on LSASS process with certain access mask references: - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) date: 2019-11-01 modified: 2026-06-29 tags: - attack.credential-access - car.2019-04-004 - attack.t1003.001 logsource: product: windows service: security detection: selection_1: EventID: 4656 ObjectName|endswith: \lsass.exe AccessMask|contains: - '0x40' - '0x1400' - '0x100000' - '0x1410' - '0x1010' - '0x1438' - '0x143a' - '0x1418' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' selection_2: EventID: 4663 ObjectName|endswith: \lsass.exe AccessList|contains: - '4484' - '4416' filter_main_specific: ProcessName|endswith: - \csrss.exe - \GamingServices.exe - \lsm.exe - \MicrosoftEdgeUpdate.exe - \minionhost.exe - \MRT.exe - \MsMpEng.exe - \perfmon.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \svchost.exe - \taskmgr.exe - \thor.exe - \thor64.exe - \vmtoolsd.exe - \VsTskMgr.exe - \wininit.exe - \wmiprvse.exe - RtkAudUService64 ProcessName|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\Microsoft\Windows Defender\Platform\ - :\Windows\SysNative\ - :\Windows\System32\ - :\Windows\SysWow64\ - :\Windows\Temp\asgard2-agent\ filter_main_generic: ProcessName|contains: :\Program Files filter_main_exact: ProcessName|endswith: - :\Windows\System32\taskhostw.exe - :\Windows\System32\msiexec.exe - :\Windows\CCM\CcmExec.exe filter_main_sysmon: ProcessName|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe AccessList|contains: '%%4484' filter_main_aurora: ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\ ProcessName|endswith: \aurora-agent-64.exe AccessList|contains: '%%4484' filter_main_scenarioengine: ProcessName|endswith: \x64\SCENARIOENGINE.EXE AccessList|contains: '%%4484' filter_main_avira1: ProcessName|contains|all: - :\Users\ - \AppData\Local\Temp\is- ProcessName|endswith: \avira_system_speedup.tmp AccessList|contains: '%%4484' filter_main_avira2: ProcessName|contains: :\Windows\Temp\ ProcessName|endswith: \avira_speedup_setup_update.tmp AccessList|contains:
Near-miss passage: Sigma rule: Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information dis. Logsource: macos / process_creation. Rule: title: System Information Discovery Using Ioreg id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0 status: test description: 'Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings. ' references: - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 modified: 2024-01-02 tags: - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /ioreg - CommandLine|contains: ioreg selection_cmd1: CommandLine|contains: - -l - -c selection_cmd2: CommandLine|contains: - AppleAHCIDiskDriver - IOPlatformExpertDevice - Oracle - Parallels - USB Vendor Name - VirtualBox - VMware condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium