critical Sigma Windows

Suspicious Handle Access to LSASS

A non-allowlisted process opening LSASS with memory-read rights - the core primitive behind Mimikatz, comsvcs.dll dumping and most credential theft tooling.

Rule source

lsass-handle-access.yml

title: Suspicious Handle Access to LSASS
id: 3f9a77c2-1b48-4d0a-b6e5-9d2c4a81f770
status: stable
description: >
  A non-allowlisted process requests read access to lsass.exe memory - the
  core primitive behind Mimikatz, comsvcs.dll dumping and most credential
  theft tooling.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: DetectionOps
date: 2026/09/02
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'     # PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1f3fff'   # PROCESS_ALL_ACCESS
  filter_endpoint_security:
    SourceImage|startswith:
      - 'C:\Program Files\Windows Defender\'
      - 'C:\Program Files\CrowdStrike\'
  filter_werfault:
    SourceImage|endswith: '\WerFault.exe'
  condition: selection and not 1 of filter_*
fields:
  - SourceImage
  - SourceProcessId
  - GrantedAccess
  - CallTrace
falsepositives:
  - Endpoint security agents - allowlist by signed publisher, never by path alone
  - Backup and DLP agents that inspect process memory
  - Windows Error Reporting during an LSASS crash
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001

Required telemetry

Sysmon - Event ID 10 (ProcessAccess)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Endpoint security agents - allowlist by signed publisher, never by path alone
Backup and DLP agents that inspect process memory
Windows Error Reporting during an LSASS crash

Validation

Atomic Red Team T1003.001-1 through -3, re-run after every Sysmon config change

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.