Detection of Unauthorized Lsass.exe Process Termination

The Local Security Authority Subsystem Service (lsass.exe) is a core Windows process responsible for enforcing security policies and managing user credentials. Malicious actors, particularly those deploying destructive wipers like DoubleZero, often target this process to force a system shutdown, bypass security logging, or disable endpoint protection mechanisms. This brief focuses on the behavioral detection of unauthorized processes requesting the PROCESS_TERMINATE access mask (0x1) against lsass.exe. Monitoring this activity via Sysmon is critical for identifying potential data destruction attempts or sophisticated evasion techniques where an attacker seeks to cripple the host security posture.

Impact

Successful termination of lsass.exe on a Windows system typically results in an immediate system crash or forced reboot, leading to service disruption, potential data loss, and the disabling of security monitoring and authentication services. This technique is characteristic of destructive campaigns where the goal is to render the system inoperable or to hide subsequent malicious activities from endpoint detection solutions.

Recommendation

Prioritized actions for detection engineering teams:

• Enable Sysmon Event ID 10 across the environment with a configuration that includes monitoring for access requests to lsass.exe.
• Deploy the provided Sigma rule to detect processes requesting PROCESS_TERMINATE access.
• Investigate any process triggering this detection to identify the parent process, binary origin, and execution context.
• Implement memory protection policies for core system processes where possible to prevent unauthorized handle acquisition.