Lion Cipher Lab
Detect LSASS credential theft from Sysmon ProcessAccess (Event ID 10)
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
LSASS — the Local Security Authority Subsystem Service — holds the secrets that unlock the rest of a network: cached password hashes, Kerberos tickets, and tokens. Reading its memory is one of the most common and highest-impact moves an intruder makes, and MITRE ATT&CK tracks it as its own sub-technique, T1003.001. But a SOC cannot simply alert on 'something touched lsass': the operating system, your antivirus, your EDR, WMI, and LSASS itself open handles to that process constantly, so the obvious rule buries the one real credential dump under a landslide of benign noise. The craft is…
What you'll learn
- Reading Sysmon ProcessAccess (Event ID 10) telemetry: SourceImage, TargetImage, GrantedAccess, CallTrace
- Decoding a GrantedAccess hex bitmask into the PROCESS_ rights it grants
- Writing a detection keyed on PROCESS_VM_READ against lsass.exe (T1003.001)
- Measuring detection precision and recall against a labeled dataset
- Tuning out legitimate LSASS accessors (AV/EDR, MsMpEng, WmiPrvSE, the OS) with an allowlist plus a CallTrace heuristic
- Naming the bypasses an EID 10 rule cannot catch, and the stronger controls (Credential Guard / RunAsPPL) that back it
Steps in this lab
- What LSASS credential theft looks like from the outside
- The one event that carries the signal: Sysmon Event ID 10
- Decode the GrantedAccess bitmask — why 0x1010 is not 0x1000
- Why the obvious rule drowns you (the judgement)
- Build the synthetic EID 10 fixture
- Write four detections and score them
- Read the results like an analyst, not a scoreboard
- Name the bypasses — an allowlist is not armour
- The stronger controls this detection sits in front of
- Where this goes next