{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/auditing/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["credential-access","windows","lsass","auditing"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAccessing the memory of the Local Security Authority Subsystem Service (LSASS) is a primary technique used by threat actors to perform credential dumping, allowing for the extraction of plaintext passwords, Kerberos tickets, and NTLM hashes. While legitimate security software and system services frequently interact with LSASS, malicious tools such as Mimikatz and custom credential stealers often attempt to open handles to the process with specific access masks to read its memory space. This detection focuses on Windows Security event logs (IDs 4656 and 4663) to identify when non-system, non-trusted processes request handle access to 'lsass.exe' using high-privilege access masks. Defenders should monitor for these events to differentiate between standard administrative activity or security product operations and potentially malicious credential harvesting attempts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the Windows host through a phishing campaign or exploit.\u003c/li\u003e\n\u003cli\u003eAttacker executes an unauthorized process or script under a non-system user context.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the process ID (PID) of 'lsass.exe' via system enumeration.\u003c/li\u003e\n\u003cli\u003eAttacker attempts to open a handle to 'lsass.exe' using Windows APIs (e.g., OpenProcess).\u003c/li\u003e\n\u003cli\u003eThe attacker requests specific access masks (e.g., 0x1f0fff) intended for memory reading.\u003c/li\u003e\n\u003cli\u003eThe Windows Security subsystem generates Event ID 4656 or 4663 due to Object Access Auditing policies.\u003c/li\u003e\n\u003cli\u003eIf successful, the attacker dumps LSASS process memory to disk or extracts credentials into the tool's buffer.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates the harvested credentials for lateral movement or domain privilege escalation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of LSASS memory access enables an attacker to obtain cleartext credentials or cryptographic material. This typically results in full domain compromise, as the attacker can impersonate highly privileged users, move laterally through the network, and maintain persistence. This behavior is commonly observed in the post-exploitation phases of ransomware attacks, APT-led espionage, and targeted data breaches.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to monitor for unauthorized access attempts to LSASS.\u003c/li\u003e\n\u003cli\u003eEnsure \u0026quot;Audit Object Access\u0026quot; and \u0026quot;Audit Handle Manipulation\u0026quot; are enabled via Group Policy to generate Event IDs 4656 and 4663.\u003c/li\u003e\n\u003cli\u003eUse the filter list in the Sigma rule to baseline and exclude known-good security products and system processes operating in your specific environment.\u003c/li\u003e\n\u003cli\u003eInvestigate any triggered events involving processes not located in protected paths (e.g., 'C:\\Program Files').\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T12:16:02Z","date_published":"2026-10-20T12:16:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lsass-access/","summary":"This brief provides a detection approach for identifying unauthorized access to the Local Security Authority Subsystem Service (LSASS) memory, a common technique used by attackers to harvest credentials.","title":"Detection of LSASS Memory Access by Non-System Processes","url":"https://feed.craftedsignal.io/briefs/2026-10-lsass-access/"}],"language":"en","title":"CraftedSignal Threat Feed - Auditing","version":"https://jsonfeed.org/version/1.1"}