Suspicious LSASS Access Via MalSecLogon
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_process_accessed" AND PROCESSNAME endswith "\lsass.exe" AND PARENTPROCESSNAME endswith "\svchost.exe" AND ACCESSRIGHT = "0x14c0" AND CALLTRACE contains "seclogon.dll" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME,Action1.SRCUSER,Action1.TARGETUSER,Action1.CALLTRACE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems)
