LSASS Access Detected via Attack Surface Reduction
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory, which is a common technique used by attackers to steal credentials. The detection is specifically triggered by Windows Defender's Attack Surface Reduction (ASR) rule for blocking credential stealing from LSASS, indicated by EventID 1121 and the target path ending with '\lsass.exe'. The rule includes filters to reduce false positives from legitimate processes that might interact with LSASS.
Sigma
