Detection: Unsigned Image Loaded by LSASS

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection deprecated as it no longer effectively identifies the intended malicious activity

Removed in version: 5.2.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: 56ef054c-76ef-45f9-af4a-a634695dcd65 Author: Patrick Bareiss, Splunk Type: TTP Product: Splunk Enterprise Security

Description

This search detects loading of unsigned images by LSASS. Deprecated because too noisy.

Search

1`sysmon` EventID=7 Image=*lsass.exe Signed=false 
2| fillnull 
3| stats count min(_time) as firstTime max(_time) as lastTime by EventID FileVersion Guid Hashes Image ImageLoaded MD5 Opcode OriginalFileName ProcessGuid ProcessID ProcessId SHA256 SecurityID Signature SignatureStatus Signed UserID dest loaded_file loaded_file_path original_file_name process_exec process_guid process_hash process_id process_name process_path service_dll_signature_exists service_dll_signature_verified signature signature_id user_id vendor_product 
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)` 
6| `unsigned_image_loaded_by_lsass_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 7	Windows	`'XmlWinEventLog'`	`'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'`

Macros Used

Name	Value
sysmon	`(source=WinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational)`
unsigned_image_loaded_by_lsass_filter	``

unsigned_image_loaded_by_lsass_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1003.001	LSASS Memory	Credential Access

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named sysmon. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.

Known False Positives

Other tools could load images into LSASS for legitimate reason. But enterprise tools should always use signed DLLs.

Associated Analytic Story

Credential Dumping

References

https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 5