KQL Search

//Detect when a process with a hash not previously seen before in your environment accesses lsass.exe via an open process API call

//Data connector required for this query - M365 Defender - Device* tables

//Microsoft Sentinel query
let knownhashes=
    DeviceEvents
    | where TimeGenerated > ago(30d) and TimeGenerated < ago (1d)
    | where ActionType == "OpenProcessApiCall"
    | where FileName == "lsass.exe"
    | distinct InitiatingProcessSHA256;
DeviceEvents
| where TimeGenerated > ago (1d)
| where ActionType == "OpenProcessApiCall"
| where FileName == "lsass.exe"
| where InitiatingProcessSHA256 !in (knownhashes)
| extend DesiredAccess = tostring(AdditionalFields.DesiredAccess)
| distinct
    DeviceName,
    InitiatingProcessAccountName,
    InitiatingProcessCommandLine,
    DesiredAccess

//Detect when a process with a hash not previously seen before in your environment accesses lsass.exe via an open process API call

//Data connector required for this query - Advanced Hunting license

//Advanced Hunting query
let knownhashes=
    DeviceEvents
    | where Timestamp > ago(30d) and Timestamp < ago (1d)
    | where ActionType == "OpenProcessApiCall"
    | where FileName == "lsass.exe"
    | distinct InitiatingProcessSHA256;
DeviceEvents
| where Timestamp > ago (1d)
| where ActionType == "OpenProcessApiCall"
| where FileName == "lsass.exe"
| where InitiatingProcessSHA256 !in (knownhashes)
| distinct DeviceName,
    InitiatingProcessAccountName,
    InitiatingProcessCommandLine,
    AdditionalFields