Memory-read handle opened against the LSASS process

Siemphony@siemphonyhighT1003.001verified in labPlaybook · Credential theft

MITRE's analytic describes a process opening a handle to lsass.exe with full access and then dumping, writing or persisting the harvested material, and Process Access is the one log source in the strategy that carries both the target and the access rights on a single event. The selection pins TargetImage to lsass.exe and matches the 0x1F0FFF mask MITRE names in its AccessMask knob alongside the other full-access variants and the minimal read masks a dumper needs — query plus VM_READ, with or without duplicate-handle rights — because a tool that asks only for what MiniDumpWriteDump requires never presents the full mask. The dump-file creation and registry steps that follow are a timed correlation Sigma cannot express, so this rule is the handle acquisition only. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0363, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Memory-read handle opened against the LSASS process2id: 3e50b6f6-5dbc-4689-bf57-4bbff2bdd1623status: experimental4description: |5  MITRE's analytic describes a process opening a handle to lsass.exe with full6  access and then dumping, writing or persisting the harvested material, and7  Process Access is the one log source in the strategy that carries both the8  target and the access rights on a single event. The selection pins TargetImage9  to lsass.exe and matches the 0x1F0FFF mask MITRE names in its AccessMask knob10  alongside the other full-access variants and the minimal read masks a dumper11  needs — query plus VM_READ, with or without duplicate-handle rights — because12  a tool that asks only for what MiniDumpWriteDump requires never presents the13  full mask. The dump-file creation and registry steps that follow are a timed14  correlation Sigma cannot express, so this rule is the handle acquisition only.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0363, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T1003/00118  - https://attack.mitre.org/detectionstrategies/DET036319author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.credential-access23  - attack.t1003.00124logsource:25  category: process_access26  product: windows27detection:28  selection:29    TargetImage|endswith: '\lsass.exe'30    GrantedAccess:31      - '0x1F0FFF'32      - '0x1F1FFF'33      - '0x1F2FFF'34      - '0x1F3FFF'35      - '0x1FFFFF'36      - '0x143A'37      - '0x1438'38      - '0x1410'39      - '0x1010'40  condition: selection41falsepositives:42  - "Endpoint protection, EDR and vulnerability-scanning agents, which read LSASS memory as part of credential-theft prevention and integrity checking. MITRE's allowlist knob is aimed at these; on this log source the only field that can carry the allowlist is SourceImage, so build the exclusion there once you know which agents your estate runs."43  - "Windows components that legitimately query LSASS with the narrower masks in this list — the Local Session Manager, WMI provider host and performance-counter collectors routinely present 0x1010 or 0x1410. Scoping the rule down to 0x1F0FFF alone, as MITRE's AccessMask knob suggests, removes most of this at the cost of missing minimal-rights dumpers."44  - "Crash reporting, memory forensics and support tooling run deliberately by an administrator during an incident or a hang investigation, which requests full access by design."45  - "Backup and privileged-access-management products that snapshot process memory or inject credential providers on managed hosts."46level: high

Splunk · SPL

Run this as a search.

index=* (TargetImage="*\\lsass.exe" AND (GrantedAccess="0x1F0FFF" OR GrantedAccess="0x1F1FFF" OR GrantedAccess="0x1F2FFF" OR GrantedAccess="0x1F3FFF" OR GrantedAccess="0x1FFFFF" OR GrantedAccess="0x143A" OR GrantedAccess="0x1438" OR GrantedAccess="0x1410" OR GrantedAccess="0x1010"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(winlog.event_data.TargetImage) LIKE "*\\\\lsass.exe" AND (TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f0fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f1fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f2fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1f3fff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1fffff" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x143a" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1438" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1410" OR TO_LOWER(winlog.event_data.GrantedAccess) == "0x1010"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetImage" type="pcre2">(?i)\\lsass\.exe$</field>    <field name="GrantedAccess" type="pcre2">(?i)(^0x1F0FFF$|^0x1F1FFF$|^0x1F2FFF$|^0x1F3FFF$|^0x1FFFFF$|^0x143A$|^0x1438$|^0x1410$|^0x1010$)</field>    <description>Memory-read handle opened against the LSASS process</description>    <mitre>      <id>T1003.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: high
Category: credential_dump
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 3e50b6f6-5dbc-4689-bf57-4bbff2bdd162

ATT&CKT1003.001

T1003.001LSASS Memory

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification4 runs

Verified in Siemphony lab

Security Datasets — LSASS memory dumped via direct syscalls (Dumpert)
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Security Datasets — LSASS dumped via comsvcs.dll MiniDump
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Security Datasets — Mimikatz sekurlsa::logonpasswords against LSASS
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Noise checkfires on 1 of 1

Fires on 1 of 1 ordinary behaviour the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pa-edr-opens-lsass
Endpoint protection opening a handle to LSASS to inspect it. Benign, extremely common, and the exact access pattern credential-dumping rules watch for.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1003.001, evaluated against their process_access events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Pick one of two shapes before deploying. Either full-access masks only
Replace the five hand-picked full-access constants with
Understand the ceiling. Sigma has no bitwise operator, so GrantedAccess can
Build the rest of AN1030 as companions rather than widening this one: MITRE's

Declared by the author

Endpoint protection, EDR and vulnerability-scanning agents, which read LSASS memory as part of credential-theft prevention and integrity checking. MITRE's allowlist knob is aimed at these; on this log source the only field that can carry the allowlist is SourceImage, so build the exclusion there once you know which agents your estate runs.
Windows components that legitimately query LSASS with the narrower masks in this list — the Local Session Manager, WMI provider host and performance-counter collectors routinely present 0x1010 or 0x1410. Scoping the rule down to 0x1F0FFF alone, as MITRE's AccessMask knob suggests, removes most of this at the cost of missing minimal-rights dumpers.
Crash reporting, memory forensics and support tooling run deliberately by an administrator during an incident or a hang investigation, which requests full access by design.
Backup and privileged-access-management products that snapshot process memory or inject credential providers on managed hosts.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

AN1030 describes a chain: an abnormal process opens a full-access handle to lsass.exe, then dumps memory, writes a file, or modifies the registry. This rule implements the first clause and stops — a Sysmon Process Access event whose target is LSASS and whose granted mask is one of nine values. Say the consequence plainly, because a learner will get it wrong: a hit is a handle, not a dump. The rule cannot distinguish a read from a dump, and LSASS handle access is a precursor shared with protected-process integrity checks and crash handling. The title is more accurate than the technique mapping implies.

02 · Telemetry you need

Sysmon EventID 10, as category: process_access / product: windows, copied verbatim from AN1030. Process Access is not on in a stock Sysmon config and is expensive; without it the rule returns nothing. Sentinel refuses the logsource, so three of four backends render.
Of AN1030's five knobs only AccessMask is implementable here. EventID 10's only allowlist-capable fields are SourceImage and CallTrace, so MITRE's ParentProcessName knob has no corresponding field at all. DumpFilePath needs file_event, CommandLinePattern needs process_creation, TimeWindow needs a correlation engine.

03 · How the logic works

One selection, two fields, implicitly ANDed: TargetImage|endswith: '\lsass.exe' and GrantedAccess as a nine-value list. endswith with the leading backslash, not the full C:\Windows\System32\lsass.exe, anchors at a filename boundary — it survives path and case variation while refusing a decoy called notlsass.exe. GrantedAccess takes no modifier because Sysmon writes it as a fixed hex string; these are exact matches, which the Wazuh rendering shows as ^0x1F0FFF$ anchors. The nine values split in two. Full access: 0x1F0FFF — the one value MITRE actually names, in its AccessMask knob — plus 0x1F1FFF, 0x1F2FFF, 0x1F3FFF and 0x1FFFFF, the PROCESS_ALL_ACCESS variants across Windows versions. Those four are authored, not MITRE's. Minimal rights: 0x1010 and 0x1410 are query-information plus PROCESS_VM_READ, the least a MiniDumpWriteDump caller needs; 0x1438 and 0x143A add VM-operation, VM-write and thread-creation bits. They are here because a tool that asks only for what it needs never presents the full mask — procdump -ma lsass.exe shows as 0x1FFFFF, but mimikatz sekurlsa::logonPasswords opens with 0x1410 and an AccessMask-knob-only rule would miss it. That trade is the lesson: widening the mask list buys the minimal-rights dumpers and costs the noise floor.

04 · Common false positives

Ruinously, as written. The rule carries no `SourceImage` filter at all, and 0x1010, 0x1410, 0x1438 and 0x143A are masks Windows components request against LSASS continuously. On a domain controller this fires from svchost.exe, wmiprvse.exe, MsMpEng.exe and the EDR agent thousands of times before an adversary does anything. False-positive entry 2 admits it in prose while the rule still ships at level: high. The reviewer's verdict: a SOC cannot run this as written, and the exclusion is a precondition, not a suggestion.
One specific miss. The false positives frame crash tooling as something "run deliberately by an administrator" — WerFault.exe is exactly what that is not. Windows Error Reporting opens LSASS with full access automatically whenever LSASS or a dependent service hangs, and it is the most common single source of genuine 0x1FFFFF-to-LSASS alerts in production.
Behind it: EDR and vulnerability scanners reading LSASS for credential-theft prevention, memory forensics during an incident, PAM and backup products snapshotting process memory.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold containing no query logic, and never executed against a log line. Tracing it forward on paper says procdump, mimikatz and `rundll32 comsvcs.dll MiniDump` would all land in the list — that is analysis, not verification, and it says nothing about the volume underneath.
tier_2: run read-only for a fortnight, rank hits by `SourceImage`, and turn the top of that list into the exclusion block the rule is missing. Expect `WerFault.exe` near the top.
tier_3: ** keep the handle rule as a context signal and alert on the correlation — handle acquisition followed by a dump-file write inside MITRE's TimeWindow — so the alert means credential theft rather than a handle that could mean anything.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/3e50b6f6-5dbc-4689-bf57-4bbff2bdd162

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@nadia-brandt
29 Aug 2026
First week of this on our estate: five figures of matches, essentially all of them our own EDR and the vulnerability scanner reading LSASS by design — which is exactly the population the description says the SourceImage allowlist is aimed at. Two allowlist entries later the daily volume is double digits, and what remains is dominated by the narrow masks, 0x1010 and 0x1410 from lsm.exe and WmiPrvSE. We ended up routing the arms differently: the full-access masks page, the minimal-read masks feed a hunt queue. One rule, two consumers, and neither of them is muted.
- @owen-mackay
  29 Aug 2026
  Second the split, with one caution against dropping the minimal-read arm to get quiet: the dumpers worth worrying about ask for exactly what MiniDumpWriteDump needs, which the description already says is why the full mask alone is not enough. And the ones that duplicate a handle out of another process never open lsass themselves — the open you see came from whoever they stole it from, which is one more reason SourceImage is the field that decides. The dump-file write the description defers as a timed correlation is where I would spend the next hour of engineering; the handle is the earliest signal, the file is the confirmation.

Memory-read handle opened against the LSASS process

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it

1 thread