Remote LSASS Process Access Through Windows Remote Management
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_process_accessed" AND (PROCESSNAME endswith "\lsass.exe" AND PARENTPROCESSNAME endswith ":\Windows\system32\wsmprovhost.exe") AND ACCESSRIGHT != "0x80000000" select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME,Action1.SRCUSER,Action1.TARGETUSER,Action1.CALLTRACE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Patryk Prauze - ING Tech
