LSASS Process Access via Windows API

from logs-endpoint.events.api-*, logs-m365_defender.event-* metadata _id, _version, _index
| where event.category == "api" and host.os.family == "windows" and
   process.Ext.api.name in ("OpenProcess", "OpenThread", "ReadProcessMemory") and
   Target.process.name == "lsass.exe" and process.executable is not null and

   // Noisy patterns
   not to_lower(process.executable) like """c:\\program files\\*.exe""" and
   not to_lower(process.executable) like """c:\\program files (x86)\\*.exe""" and
   not to_lower(process.executable) like """c:\\programdata\\microsoft\\windows defender\\platform\\msmpeng.exe""" and
   not to_lower(process.executable) like """c:\\programdata\\microsoft\\windows defender\\platform\\*\\msmpeng.exe"""

 /* normalize process paths to reduce known random patterns in process.executable */
| eval Esql.process_path = replace(process.executable, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}
| ns[a-z][A-Z0-9]{3,4}\.tmp
| DX[A-Z0-9]{3,4}\.tmp
| 7z[A-Z0-9]{3,5}\.tmp
| [0-9\.\-\_]{3,})""", "")

// Group by process path
| stats Esql.access_count = count(*),
        Esql.count_distinct_hosts = count_distinct(host.id),
        Esql.host_id_values = VALUES(host.id),
        Esql.host_name_values = VALUES(host.name),
        Esql.user_name_values = VALUES(user.name),
        Esql.process_pid_values = VALUES(process.entity_id),
        Esql.process_executable_values = VALUES(process.executable),
        Esql.data_stream_namespace.values = VALUES(data_stream.namespace),
        Esql.user_name_values = VALUES(user.name) by Esql.process_path

// Limit to rare instances limited to 1 unique host
| where Esql.count_distinct_hosts == 1 and Esql.access_count <= 3

// Extract the single host ID and process into their corresponding ECS fields for alerts exclusion
| eval host.id = mv_min(Esql.host_id_values),
       host.name = mv_min(Esql.host_name_values),
       process.executable = mv_min(Esql.process_executable_values), 
       user.name = mv_min(Esql.user_name_values)

// Add the new field to the keep statement
| keep Esql.*, host.id, host.name, user.name, process.executable