Elastic Defend high stable eql

LSASS Access Attempt from an Unsigned Executable

Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) by an unsigned process that was recently dropped. Adversaries may attempt to access credential material stored in the process memory of LSASS.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and
   (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
   not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
   not process.hash.sha256 : "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a"]
 [credential_access where
  startswith~(process.thread.Ext.call_stack_final_user_module.path, process.executable)]

Field Validations

Loading…

Comments (0)

Loading comments...