other tools can access lsass for legitimate reasons and generate an event. in these cases, tweaking the search may help eliminate noise.

Techniques

T1003.001

Sample rules

Create Remote Thread into LSASS

source: splunk
technicques:
- T1003.001

Description

The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. Analysts should investigate to differentiate between legitimate tools and potential threats.

Detection logic

`sysmon` EventID=8 TargetImage=*lsass.exe 
| stats count min(_time) as firstTime max(_time) as lastTime by dest, EventCode, TargetImage, TargetProcessId 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `create_remote_thread_into_lsass_filter`