Detectionmediumtest

Unsigned Image Loaded Into LSASS Process

Loading unsigned image (DLL, EXE) into LSASS process

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Teymur Kheirkhabarov, oscd.communityCreated Tue Oct 22Updated Sat Nov 27857c8db3-c89b-42fb-882b-f681c7cf4da2windows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        Image|endswith: '\lsass.exe'
        Signed: 'false'
    condition: selection

False Positives

Valid user connecting using RDP

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

857c8db3-c89b-42fb-882b-f681c7cf4da2

Status

test

Level

medium

Type

Detection

Created

Tue Oct 22

Modified

Sat Nov 27

Author

Path

rules/windows/image_load/image_load_lsass_unsigned_image_load.yml

Raw Tags

attack.credential-accessattack.t1003.001