Detectionhighstable
Remote LSASS Process Access Through Windows Remote Management
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Patryk Prauze - ING TechCreated Mon May 20Updated Wed Nov 29aa35a627-33fb-4d04-a165-d33b4afca3e8windows
Log Source
WindowsProcess Access
ProductWindows← raw: windows
CategoryProcess Access← raw: process_access
Events when a process opens a handle to another process, commonly used for credential dumping via LSASS.
Detection Logic
Detection Logic2 selectors
detection:
selection:
TargetImage|endswith: '\lsass.exe'
SourceImage|endswith: ':\Windows\system32\wsmprovhost.exe'
filter_main_access:
GrantedAccess: '0x80000000'
condition: selection and not 1 of filter_main_*False Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
References
MITRE ATT&CK
Rule Metadata
Rule ID
aa35a627-33fb-4d04-a165-d33b4afca3e8
Status
stable
Level
high
Type
Detection
Created
Mon May 20
Modified
Wed Nov 29
Author
Path
rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml
Raw Tags
attack.credential-accessattack.executionattack.t1003.001attack.t1059.001attack.lateral-movementattack.t1021.006attack.s0002