LSASS Access From Non System Account

Title: LSASS Access From Non System Account
Status: test
Description:Detects potential mimikatz-like tools accessing LSASS from non system account
References:
  -https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-06-20
modified:2023-12-11
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID:
      -'4663'
      -'4656'

    AccessMask:
      -'0x100000'
      -'0x1010'
      -'0x1400'
      -'0x1410'
      -'0x1418'
      -'0x1438'
      -'0x143a'
      -'0x1f0fff'
      -'0x1f1fff'
      -'0x1f2fff'
      -'0x1f3fff'
      -'0x40'
      -'143a'
      -'1f0fff'
      -'1f1fff'
      -'1f2fff'
      -'1f3fff'

    ObjectType: 'Process'
    ObjectName|endswith: '\lsass.exe'
  filter_main_service_account:
    SubjectUserName|endswith: '$'
  filter_main_generic:
    ProcessName|contains:
      -':\Program Files\'
      -':\Program Files (x86)\'

  filter_main_wmiprvse:
    ProcessName: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
    AccessMask: '0x1410'
  filter_optional_steam:
    ProcessName|contains: '\SteamLibrary\steamapps\'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: medium