Sysmon created remote thread to LSASS Process

Question

I have researched some ways to detect LSASS Credential Dumping in my infrastructure. I found that Sysmon often create remote thread (EventCode=8) to lsass.exe that looks very suspicious.

Does it legit? Or some malware already injected to my Sysmon agent?

Answer 1

Hello,

Didn't observd your behavior in our lab, but we observerd a process access from sysmon to lsass with granted right 0x1fffff, so it could be possible your unexpected behaviour could also be normal. I would be really interested to understand why you observe this remote thread, or me this process access thought.

Answer 2

Can you please elaborate more on how did you handle or investigated this ? After you saw sysmon creates remote thread to lsass?