title: Suspicious LSASS Process Access

id: dcfda42d-c1a7-4106-aa96-7912201d9221

status: experimental

description: >

  Detects process access to lsass.exe with access rights commonly used to read

  process memory (credential dumping). Tuned to the granted-access masks seen with

  Mimikatz, comsvcs MiniDump, and similar tooling rather than the broad 0x1010 alone.

references:

  - https://attack.mitre.org/techniques/T1003/001/

  - https://github.com/SwiftOnSecurity/sysmon-config

author: Zion Boggan

date: 2026-05-12

tags:

  - attack.credential_access

  - attack.t1003.001

logsource:

  product: windows

  category: process_access

detection:

  selection:

    TargetImage|endswith: '\lsass.exe'

    GrantedAccess:

      - '0x1010'

      - '0x1410'

      - '0x143a'

      - '0x1438'

      - '0x1fffff'

  filter_known:

    SourceImage|endswith:

      - '\wininit.exe'

      - '\csrss.exe'

      - '\MsMpEng.exe'

      - '\wmiprvse.exe'

  condition: selection and not filter_known

falsepositives:

  - EDR and AV products legitimately reading LSASS; baseline and add to filter_known.

level: high