Process opens a password manager process with memory-read access

Siemphony@siemphonyhighT1555.005unverified

Matches Sysmon EventID 10 process-access records where the target is a desktop password-manager process and the granted access mask carries the rights needed to read another process's memory — the same access-mask literals long used in this corpus's LSASS-access rules, reused here because they name Windows API rights (PROCESS_VM_READ and friends) rather than anything specific to lsass.exe, so they apply equally to KeePass, KeePassXC, 1Password and Bitwarden. AN1641 also names two other log sources — Security 4688 process creation and Sysmon EventID 15 file-stream hashing — but neither carries the memory-read behaviour the analytic describes; 15 records Zone.Identifier stream creation on downloaded files, not vault access, so only the process-access leg is authored. Two accessors that legitimately open these processes with broad rights are excluded outright rather than left for the analyst, because they are common enough to swamp the rule unfiltered. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0597, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (((TargetImage="*\\KeePass.exe" OR TargetImage="*\\KeePassXC.exe" OR TargetImage="*\\1Password.exe" OR TargetImage="*\\1Password7.exe" OR TargetImage="*\\Bitwarden.exe") AND (GrantedAccess="*0x1010*" OR GrantedAccess="*0x1038*" OR GrantedAccess="*0x1400*" OR GrantedAccess="*0x1410*" OR GrantedAccess="*0x1438*" OR GrantedAccess="*0x143a*" OR GrantedAccess="*0x1fffff*")) AND NOT ((SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\WerFault.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(TargetImage) LIKE "*\\\\keepass.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\keepassxc.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\1password.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\1password7.exe" OR TO_LOWER(TargetImage) LIKE "*\\\\bitwarden.exe") AND (TO_LOWER(GrantedAccess) LIKE "*0x1010*" OR TO_LOWER(GrantedAccess) LIKE "*0x1038*" OR TO_LOWER(GrantedAccess) LIKE "*0x1400*" OR TO_LOWER(GrantedAccess) LIKE "*0x1410*" OR TO_LOWER(GrantedAccess) LIKE "*0x1438*" OR TO_LOWER(GrantedAccess) LIKE "*0x143a*" OR TO_LOWER(GrantedAccess) LIKE "*0x1fffff*")) AND NOT ((TO_LOWER(process.executable) LIKE "*\\\\msmpeng.exe" OR TO_LOWER(process.executable) LIKE "*\\\\werfault.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_access,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetImage" type="pcre2">(?i)(\\KeePass\.exe$|\\KeePassXC\.exe$|\\1Password\.exe$|\\1Password7\.exe$|\\Bitwarden\.exe$)</field>    <field name="GrantedAccess" type="pcre2">(?i)(0x1010|0x1038|0x1400|0x1410|0x1438|0x143a|0x1fffff)</field>    <field name="SourceImage" negate="yes" type="pcre2">(?i)(\\MsMpEng\.exe$|\\WerFault\.exe$)</field>    <description>Process opens a password manager process with memory-read access</description>    <mitre>      <id>T1555.005</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"process_access","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_access / windows
Level: high
Category: browser_credential_theft
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 37af6ef2-780c-4c7e-85a4-22e33479c829

ATT&CKT1555.005

T1555.005Password Managers

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

AN1641 describes suspicious access to password-manager processes — process injection, memory reads, or vault-DLL usage against KeePass, 1Password, LastPass, or Bitwarden. This rule implements the memory-read leg: a Sysmon process-access event where the target is a known password-manager binary and the granted access mask carries rights consistent with reading another process's memory. A hit is a handle with broad rights on the vault process — not proof credentials were actually extracted, the same caveat that applies to every process-access rule in this corpus.

02 · Telemetry you need

Sysmon EventID 10, category: process_access / product: windows — not on in a stock Sysmon config and expensive to collect. AN1641 also names Security 4688 (process creation) and Sysmon EventID 15 (file-stream hashing); neither carries the memory-read behaviour the analytic actually describes. EventID 15 records Zone.Identifier stream creation on downloaded files — relevant to where a vault file came from, not to someone reading a running process's memory — so only the process-access leg is authored. Sentinel refuses this logsource outright; three of four backends render.

03 · How the logic works

Three conditions: selection_target matches TargetImage ending in KeePass.exe, KeePassXC.exe, 1Password.exe, 1Password7.exe, or Bitwarden.exe; selection_access matches GrantedAccess against seven hex masks; filter_benign excludes two SourceImage values. The condition is selection_target and selection_access and not filter_benign. The access-mask list is worth tracing carefully, because the description overstates its own provenance. It says these are "the same access-mask literals long used in this corpus's LSASS-access rules" — reused, it claims, because they name Windows API rights (PROCESS_VM_READ and friends) rather than anything LSASS-specific. A reviewer checked that claim against the actual T1003.001 rule in this corpus and found it overlaps on only five of seven-to-nine values: two here (0x1038, 0x1400) are new, and T1003.001's four 0x1F_FFF full-access variants are dropped entirely. "The same literals" is wrong; "drawn from the same access-mask family" would have been accurate. This matters beyond wording — it's a live instance of AUTHORING.md's own rule about not attributing authored values to a source they didn't come from, caught here in the pipeline's own reuse of its earlier work rather than in MITRE's brief. The filter_benign block is the rule's best design choice: rather than just disclosing that Defender and crash-reporting tools generate noise, it excludes MsMpEng.exe and WerFault.exe by SourceImage outright, pre-empting the dominant false-positive sources before they inflate the count.

04 · Common false positives

Even with the two exclusions, three sources remain: any other AV or EDR engine performing the same broad-rights scan under a different binary name; any other crash-reporting or diagnostic tool capturing a minidump; and a developer or support engineer attaching a debugger during troubleshooting, which requests the same rights a credential-scraping attempt would. A reviewer also flagged a specific miss none of the three false positives name: Electron-based apps like Bitwarden commonly open a handle to their own already-running process to enforce single-instance behaviour on a second launch — a legitimate same-app-family source with no entry in the list.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line. `level: high` is defensible on paper because the dominant noise sources were filtered rather than merely disclosed, but that is still analysis, not evidence.
tier_2: means confirming the exclusion list against real `SourceImage` volume and adding the Electron case.
tier_3: ** would correlate this with a subsequent file write to see whether the memory read was followed by exfiltration, turning a handle into a story.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the missed Electron single-instance case, distinguishable in principle by SourceImage matching the same binary family as TargetImage. Consider whether GrantedAccess|contains — used here with exact hex literals, which Sysmon always emits as a single fixed string — should be plain equality instead, matching the tighter convention T1003.001 uses for the same field; contains buys nothing here and is theoretically looser than warranted. On evasion: duplicating an already-open handle from a process that previously opened the target (DuplicateHandle-based theft) generates no fresh Process Access event and evades entirely, as does renaming the target binary or targeting a browser-integrated password manager with no standalone process.

Declared by the author

Windows Defender's real-time behaviour engine (MsMpEng.exe) opening a running password-manager process with broad access rights as part of routine scanning; excluded by SourceImage above but a differently-named third-party AV or EDR engine doing the same will still match.
WerFault.exe capturing a crash dump of KeePass, 1Password or Bitwarden after the application faults, which requires exactly this level of process access to write the minidump; excluded here but any other crash-reporting or diagnostic tool performing the same capture will still match.
A developer or support engineer attaching a debugger (e.g., Visual Studio, WinDbg) to a password-manager process during troubleshooting, which requests the same broad access rights as a credential-scraping attempt.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1555.005, evaluated against their process_access events.

Share this rule

/u/siemphony/37af6ef2-780c-4c7e-85a4-22e33479c829

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

1 thread

@hana-kobayashi
23 Aug 2026
The target list is the four you would expect, and across tenants we had to add Dashlane, NordPass and Enpass before it covered what people actually run. Suggestion: make the target image list the documented tuning point rather than the access mask. The mask is a Windows API fact and will not change; the set of password managers in an estate changes every procurement cycle.
- @owen-mackay
  24 Aug 2026
  Worth separating 0x1fffff from the narrower masks while you are at it. Legitimate tooling almost never asks for everything; when it does it is nearly always a debugger, and that case is already in the false-positive list. A full-access open on a vault process is a different conversation from a read-only one and deserves its own severity.

Process opens a password manager process with memory-read access

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it

1 thread