LSASS Memory Access by Tool With Dump Keyword In Name
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_process_accessed" AND PROCESSNAME endswith "\lsass.exe" AND PARENTPROCESSNAME contains "dump" AND (ACCESSRIGHT endswith "10,30,50,70,90,B0,D0,F0,18,38,58,78,98" OR ACCESSRIGHT endswith "B8,D8,F8,1A,3A,5A,7A,9A,BA,DA,FA,0x14C2,FF") select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME,Action1.SRCUSER,Action1.TARGETUSER,Action1.CALLTRACE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
