CmdID

CmdID / Files

lsass.exe

Local Security Authority Process file version info

Program on Windows 10 known copies with hashes 41 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real lsass.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionLocal Security Authority Process

10 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\lsass.exe · signed by Microsoft Windows

c32f4526ab20443b20ae7b8219d522bcf6193d942b176a193929638abb0f2da6

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

7fe327ae2dd924e2318796508b6cff5fd6b70a3deb30a2b7c7403abdbd805462

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

56e91451fead9946aca8e2f0aae99fdea302fd90f0708f68013bddedab580f3b

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

c41f0eca09cbcec776e807522c048a9e7a2d92cc3b4eccde2f8f6c42536ad094

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

b77aa726acd44c7c89d32dd46aa07583b88fbe2c34aed394eb6e005824e40893

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

d70219dbe8cda2f93972ea4574aa47e57b61480ef31c69510a8faf681b0bff46

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\lsass.exe · signed by Microsoft Windows

aa52b2d3dd4b9b47ff4496c0460bdedda791354018cf0782b899ef28acee8d21

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

bbc83e4759d4b82bad31e371ad679aa414c72273bf97cee5aed8337ed8a4d79f

10.0.14393.2580 (rs1_release_inmarket.181009-1745) · C:\Windows\system32\lsass.exe · signed by Microsoft Windows

d957a03c6ea35cbf0c90b0b088df07e7803a1a3eeb4ba889038f88db066bbdc4

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\lsass.exe · signed by Microsoft Windows Publisher

9c7229f10f11d18e1fed6395391a46225a84b421034b9ab6f81af7430fdc556f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name lsass.exe
criticalPotential Credential Dumping Via LSASS Process CloneFlorian Roth (Nextron Systems), Samir Bousseaden
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highHackTool - CrackMapExec Process PatternsFlorian Roth (Nextron Systems)
highHackTool - XORDump ExecutionFlorian Roth (Nextron Systems)
highLSASS Process Reconnaissance Via Findstr.EXEFlorian Roth (Nextron Systems)
highPotential Credential Dumping Via WER@pbssubhash , Nasreddine Bencherchali
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)
lowWindows Processes Suspicious Parent Directoryvburov

Sigma names lsass.exe in 41 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.