Lesson 148 — LSASS Was Accessed by an Unexpected Process

Case briefing

Stage 1 — reconstruct process activity around the LSASS event

Begin with the known device and alert time. Preserve command-line and parent-process context so the LSASS clue can be placed into the endpoint timeline.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:27:00);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 10m .. TargetTime + 10m)
| where FileName in~ ("lsass.exe", "rundll32.exe", "powershell.exe", "cmd.exe")
    or ProcessCommandLine contains "lsass"
| project Timestamp, AccountName, FileName, ProcessCommandLine,
          ProcessId, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessId
| order by Timestamp asc

Stage 2 — examine Defender alert evidence

Process-creation telemetry does not describe every type of process interaction. If Defender has generated alert evidence, inspect AlertEvidence for the entities and artefacts associated with the detection.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:27:00);
AlertEvidence
| where Timestamp between (TargetTime - 15m .. TargetTime + 15m)
| where DeviceName =~ TargetDevice
| project Timestamp, EntityType, EvidenceRole, DeviceName,
          AccountName, FileName, ProcessCommandLine,
          SHA1, RemoteIP, AdditionalFields
| order by Timestamp asc

Stage 3 — follow the unexpected process

Pivot on the process implicated in the LSASS-related evidence. Examine its executions and children around the incident window to determine how it entered the process tree and what it did next.

let TargetDevice = "WS-FIN-042";
let TargetProcess = "rundll32.exe";
let TargetTime = datetime(2026-08-18 01:27:00);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 15m .. TargetTime + 15m)
| where FileName =~ TargetProcess
    or InitiatingProcessFileName =~ TargetProcess
| project Timestamp, AccountName, FileName, ProcessCommandLine,
          ProcessId, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessId, SHA1
| order by Timestamp asc

Stage 4 — establish process prevalence

Before calling the process abnormal, look at how it normally appears across the estate. Compare devices, accounts and command lines rather than relying on the executable name alone.

let TargetProcess = "rundll32.exe";
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ TargetProcess
| summarize FirstSeen=min(Timestamp),
            LastSeen=max(Timestamp),
            Executions=count(),
            Devices=dcount(DeviceId),
            DeviceNames=make_set(DeviceName, 50),
            Accounts=make_set(AccountName, 50),
            Commands=make_set(ProcessCommandLine, 50)
          by FileName
| order by FirstSeen asc

Stage 5 — place credential access into the attack timeline

Finish by rebuilding the relevant process sequence around the credential-access clue and determine whether it logically follows the execution and persistence activity already established.

let TargetDevice = "WS-FIN-042";
let StartTime = datetime(2026-08-18 01:22:00);
let EndTime = datetime(2026-08-18 01:32:00);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (StartTime .. EndTime)
| where FileName in~ ("powershell.exe", "cmd.exe", "rundll32.exe", "lsass.exe")
    or ProcessCommandLine contains "lsass"
| project Timestamp, AccountName, InitiatingProcessFileName,
          FileName, ProcessCommandLine, ProcessId, InitiatingProcessId
| order by Timestamp asc

Agent Foskett's credential-access timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft Defender XDR surfaced LSASS-related security evidence on WS-FIN-042 during the same incident window as the suspicious process execution, outbound network activity and persistence mechanisms identified earlier. The process associated with the evidence was investigated using process ancestry, command-line, account and timestamp context and aligned with the existing suspicious execution chain. This supports a credential-access hypothesis; however, the available evidence should not be overstated as proof that credentials were successfully extracted or subsequently used. Further investigation should correlate any resulting authentication and lateral-movement activity.

Lesson 148 key takeaways

• LSASS-related evidence deserves high-priority investigation because of its role in Windows authentication.
• DeviceProcessEvents helps reconstruct process creation, command lines and ancestry around the event.
• AlertEvidence can provide additional entity context from Defender detections.
• Different hunting tables describe different parts of the incident.
• A legitimate Windows process name does not guarantee legitimate behaviour.
• Process ancestry and command-line context can be more useful than filename alone.
• Prevalence is supporting context, not a maliciousness verdict.
• Correlate credential-access clues with the wider execution and persistence timeline.
• Distinguish suspected credential access from confirmed credential theft.
• Write conclusions at exactly the strength supported by the evidence.

Module 12 — the attack chain continues

Lesson 147 uncovered registry persistence. Lesson 148 now identifies behaviour consistent with credential access. Next we investigate whether the account authenticated to another endpoint only minutes later.