title: Rare GrantedAccess Flags on LSASS Access
id: 678dfc63-fefb-47a5-a04c-26bcf8cc9f65
related:
  - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
    type: obsoletes
status: experimental
description: Detects process access to LSASS memory with suspicious access flags 0x410 and 0x01410 (spin-off of similar rule)
author: Florian Roth
date: 2022/03/13
references:
    - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
    - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
    - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
    - http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
tags:
    - attack.credential_access
    - attack.t1003.001
    - attack.s0002
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|endswith: '10'
    # Absolute paths to programs that cause false positives
    filter1:
        SourceImage:
            - 'C:\WINDOWS\system32\taskmgr.exe'
            - 'C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe'
            - 'C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe'
            - 'C:\WINDOWS\system32\taskhostw.exe'
            - 'C:\Users\\*\AppData\Local\Programs\Microsoft VS Code\Code.exe'
            - 'C:\Program Files\Windows Defender\MsMpEng.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\System32\lsass.exe'
            - 'C:\WINDOWS\System32\perfmon.exe'
    # Windows Defender
    filter2:
        SourceImage|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
        SourceImage|endswith: '\MsMpEng.exe'
    # Microsoft Gaming Services
    filter3:
        SourceImage|startswith: 'C:\Program Files\WindowsApps\'
        SourceImage|endswith: '\GamingServices.exe'
    # Process Explorer
    filter4:
        SourceImage|endswith:
            - '\PROCEXP64.EXE'
            - '\PROCEXP.EXE'
    # VMware Tools
    filter5:
        SourceImage|startswith: 'C:\ProgramData\VMware\VMware Tools\'
        SourceImage|endswith: '\vmtoolsd.exe'
    # Antivirus and EDR agents
    filter6:
        SourceImage|startswith:
            - 'C:\Progra Files\'
            - 'C:\Progra Files (x86)\'
        SourceImage|contains:
            - 'Antivirus'
    filter7:
        SourceImage: 'C:\WINDOWS\system32\wbem\wmiprvse.exe'
    filter8:
        SourceImage: 'C:\Windows\sysWOW64\wbem\wmiprvse.exe'
    filter_mcafee:
        SourceImage: 'C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHOST.exe'
    filter_nextron:
        SourceImage|startswith: 'C:\Windows\Temp\asgard2-agent\'
        SourceImage|endswith: 
            - '\thor64.exe'
            - '\thor.exe'
    # Generic Filter for 0x1410 filter (caused by so many programs like DropBox updates etc.)
    filter_generic:
        SourceImage|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\WINDOWS\system32\'
    filter_localappdata:
        SourceImage|contains|all:
            - 'C:\Users\'
            - '\AppData\Local\'
        SourceImage|endswith:
            - '\Microsoft VS Code\Code.exe'
            - '\software_reporter_tool.exe'
            - '\DropboxUpdate.exe'
            - '\MBAMInstallerService.exe'
    condition: selection and not 1 of filter*
fields:
    - User
    - SourceImage
    - GrantedAccess
falsepositives:
    - Legitimate software accessing LSASS process for legitimate reason
level: medium
