other tools can access lsass for legitimate reasons and generate an event. in these cases, tweaking the search may help eliminate noise.

splunk

Techniques

Sample rules

Create Remote Thread into LSASS

source: splunk
technicques:

Description

The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). This behavior is identified using Sysmon EventID 8 logs, focusing on processes that create remote threads in lsass.exe. This activity is significant because it is commonly associated with credential dumping, a tactic used by adversaries to steal user authentication credentials. If confirmed malicious, this could allow attackers to gain unauthorized access to sensitive information, leading to potential compromise of the entire network. Analysts should investigate to differentiate between legitimate tools and potential threats.

Detection logic

`sysmon`
EventID=8
TargetImage="*\\lsass.exe"

| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(NewThreadId) as "NewThreadId"
              values(StartAddress) as "StartAddress"
  by dest signature_id signature
     SourceProcessGuid SourceProcessId SourceImage
     TargetProcessGuid TargetProcessId TargetImage
     StartModule StartFunction vendor_product

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `create_remote_thread_into_lsass_filter`