You Bet Your Lsass: Hunting LSASS Access
Comprehensive guide to detecting LSASS credential dumping - analyzing Mimikatz, Cobalt Strike, and other tools with updated Splunk detections.
Originally published on the Splunk Security Blog
Read the full article: You Bet Your Lsass
The LSASS Target
LSASS (Local Security Authority Subsystem Service) is the primary target for credential theft. Mimikatz, Cobalt Strike, and countless other tools all target LSASS memory.
Understanding GrantedAccess
When a process accesses LSASS, Windows logs the requested permissions:
| Value | Meaning |
|---|---|
| 0x1010 | PROCESS_VM_READ + PROCESS_QUERY_LIMITED_INFORMATION |
| 0x1410 | PROCESS_VM_READ + PROCESS_QUERY_INFORMATION |
| 0x1fffff | PROCESS_ALL_ACCESS |
Updated Detection
Our enhanced Sysmon query:
`sysmon` EventCode=10 TargetImage=*lsass.exe
GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000")
CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*")
| stats count min(_time) as firstTime max(_time) as lastTime
by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUserKey Observations
User Context Matters
- Normal:
NT AUTHORITY\SYSTEMaccessing LSASS - Suspicious:
DOMAIN\useraccessing LSASS
Tool Variations
Different tools use different access patterns. Test with multiple:
- Mimikatz
- Invoke-Mimikatz
- Cobalt Strike
- ProcDump
New Analytics
- Windows Hunting System Account Targeting Lsass - All LSASS access
- Windows Non-System Account Targeting Lsass - User accounts accessing LSASS
- Windows Possible Credential Dumping - Enhanced GrantedAccess detection
Read the full analysis: You Bet Your Lsass
Related Modules
Atomics on a Friday
Weekly YouTube show exploring atomic tests, detection engineering, and security research. Live demonstrations and deep dives into attack techniques.
Bootloaders.io
A curated list of known malicious bootloaders for various operating systems. Track and catalog bootloader threats with detection rules and hash prevention.