name: Remote thread creation into LSASS
id: e3ce8d6f-c260-48d6-9398-3c1c71726297
version: 1.0.1
description: |
  Identifies the creation of a remote thread in LSASS (Local Security And Authority Subsystem Service)
  by untrusted or suspicious processes. This may indicate attempts to execute code inside the LSASS process
  in preparation for credential stealing.
labels:
   tactic.id: TA0006
   tactic.name: Credential Access
   tactic.ref: https://attack.mitre.org/tactics/TA0006/
   technique.id: T1003
   technique.name: OS Credential Dumping
   technique.ref: https://attack.mitre.org/techniques/T1003/
   subtechnique.id: T1003.001
   subtechnique.name: LSASS Memory
   subtechnique.ref: https://attack.mitre.org/techniques/T1003/001/

condition: >
  create_remote_thread and kevt.arg[exe] imatches '?:\\Windows\\System32\\lsass.exe'
    and
  (ps.name iin script_interpreters or ps.name ~= 'rundll32.exe' or pe.is_signed = false or pe.is_trusted = false)

min-engine-version: 2.0.0
