LSASS Process Access via Windows API

This detection rule identifies attempts to access the Local Security Authority Subsystem Service (LSASS) process by monitoring for specific Windows API calls: OpenProcess, OpenThread, and ReadProcessMemory. The LSASS process is a critical Windows component that manages user authentication and security policies. Attackers often target LSASS to dump credentials stored in its memory, which can then be used for lateral movement, privilege escalation, and domain compromise. The rule aims to detect unauthorized access attempts indicative of credential access techniques, specifically targeting the lsass.exe process. This is important for defenders because successful credential dumping can lead to widespread compromise of sensitive resources.

Attack Chain

1. Initial Access: The attacker gains initial access to the system through various means (e.g., phishing, exploitation of vulnerabilities, or compromised credentials).
2. Execution: The attacker executes a malicious process or script on the compromised system. This process could be a custom tool, a publicly available credential dumping tool (e.g., Mimikatz), or a script designed to interact with the Windows API.
3. Privilege Escalation (If Necessary): The attacker may need to escalate privileges to gain sufficient access to LSASS. This could involve exploiting system vulnerabilities or using techniques like token impersonation.
4. LSASS Handle Access: The malicious process uses the OpenProcess or OpenThread API calls to obtain a handle to the LSASS process (lsass.exe). The ReadProcessMemory API is then called to read the contents of the LSASS process's memory.
5. Credential Extraction: The attacker parses the memory contents of LSASS to extract sensitive information, such as user credentials (passwords, NTLM hashes, Kerberos tickets).
6. Lateral Movement: The attacker uses the stolen credentials to move laterally to other systems on the network, gaining access to additional resources and expanding their control.
7. Persistence (Optional): The attacker may establish persistence mechanisms to maintain access to the compromised systems, ensuring they can return even if the initial entry point is detected.
8. Impact: The attacker achieves their final objectives, which could include data theft, system disruption, or deployment of ransomware.

Impact

Successful exploitation can lead to the compromise of user accounts, including those with administrative privileges. This allows attackers to move laterally within the network, access sensitive data, and potentially disrupt critical business operations. The impact can range from data breaches and financial losses to reputational damage and regulatory penalties. While the exact number of victims and sectors targeted can vary, the potential for widespread compromise makes this a critical threat to monitor.

Recommendation

• Deploy the Sigma rule Detect LSASS Process Access to your SIEM to identify processes attempting to access LSASS memory via OpenProcess or OpenThread. Tune the rule based on your environment to reduce false positives.
• Enable Sysmon process creation logging to ensure the necessary event data is available for the Sigma rules to function correctly.
• Investigate any alerts generated by the Detect LSASS Process Access rule, focusing on the process execution chain and the requested access rights to the LSASS process. Reference the Microsoft documentation on process security and access rights to interpret the access rights (process.Ext.api.parameters.desired_access field).
• Monitor network connections originating from processes that have accessed LSASS, as this could indicate lateral movement or exfiltration of stolen credentials.
• Implement the Osquery queries described in the source document to identify potentially suspicious services running on user accounts or unsigned executables.