Process access and access masks

lsass.exe (Local Security Authority Subsystem Service) holds the credentials of logged-on users in memory. Reading that memory is how tools such as Mimikatz, and the comsvcs.dll MiniDump technique, obtain password hashes and Kerberos tickets. To read another process's memory, a program first opens a handle to it and asks for specific rights. Sysmon Event ID 10 (category: process_access) records that request.

Fields

• SourceImage: the program that opened the handle.
• TargetImage: the process it opened.
• GrantedAccess: the rights it received, as a hexadecimal bit mask.
• CallTrace: the chain of code locations that made the request. An UNKNOWN entry means code that was not loaded from a file on disk, which is typical of injected code.

Reading an access mask

Each bit of the mask is one right. The ones that matter here:

• 0x0010 PROCESS_VM_READ: read the process's memory.
• 0x0400 PROCESS_QUERY_INFORMATION and 0x1000 PROCESS_QUERY_LIMITED_INFORMATION: ask about the process.
• 0x1fffff PROCESS_ALL_ACCESS: every right.

0x1410 is 0x1000 + 0x0400 + 0x0010: it includes the right to read memory. 0x1400 does not.

Sigma has no bit operations

A Sigma value is compared as text (or as a number with gt, lt and their variants); there is no "bit 0x10 is set". Rules list the masks that matter, as they appear in the log. That list has to come from data: a mask that does not appear in your logs today can appear tomorrow from a different tool. SigmaHQ rules for LSASS access use lists of this kind, often together with CallTrace conditions.

In the exercise you will see that normal software also reads LSASS memory: Windows Installer and an update service ask for exactly these rights. The LSASS challenge is about separating them from the attack tools.