[rule]
description = """
Identifies attempt to access the Local Security Authority Subsystem Service (LSASS) by an unsigned process that was
recently dropped. Adversaries may attempt to access credential material stored in the process memory of LSASS.
"""
id = "6661d3b1-0baa-413c-9843-d83b8f9baaee"
license = "Elastic License v2"
name = "LSASS Access Attempt from an Unsigned Executable"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/bits-and-bytes-analyzing-bitsloth"]
version = "1.0.16"
query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and
(process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
not process.hash.sha256 : "1c6af94b26f369e2c10819eefb869f873e5540e2c1b7bf4c7c632fc03d67368a"]
[credential_access where
startswith~(process.thread.Ext.call_stack_final_user_module.path, process.executable)]
'''
min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.001"
name = "LSASS Memory"
reference = "https://attack.mitre.org/techniques/T1003/001/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.7.0"