Extra or Missing Instances

Normal and Suspicious

A clean machine sits beside a suspicious one, and the pointer marks where to look.

How to Confirm It

Work through these in order. Each step names the page that shows how.

1. Count copies by name and session against a clean machine of the same build. Many svchost.exe are normal, but a second lsass.exe or services.exe is not.Process Listings and Scans
2. Read each extra copy's parent and start time. An lsass.exe under lsass.exe is a clone, and one under anything else is an impostor.Process Trees and Call Chains
3. In a memory image, set the active list against the pool scan and the other views (windows.malware.psxview). A process the scans find but the list lacks has exited if it has an exit time, and one without may have been unlinked to hide it.Process Listings and Scans
4. For a second lsass.exe, find what opened the original. Sysmon event 10 in Microsoft-Windows-Sysmon/Operational, where its configuration logs process access, and Defender's OpenProcessApiCall rows in DeviceEvents name the process that asked.Handles, Pipes and Mutexes

What Defenders See

Each record names its log and what must be switched on to get it.

False Positives

Many svchost.exe copies are normal, and each signed-in person adds per-user service hosts as well.

Each new session, from a second person or a Remote Desktop connection, brings its own csrss.exe and winlogon.exe, started by that session's own copy of smss.exe.

Blind Spots

A live listing shows only what runs now, so a clone made and closed within seconds survives only in creation records.

windows.pslist and windows.pstree read the active list, so a process unlinked from it is missing there. windows.malware.psxview shows whether pool scans, thread scans or csrss.exe's handles still find it.

Hunt It

The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.

// Any lsass.exe that wininit.exe did not create, the only parent Windows uses for itDeviceProcessEvents| where Timestamp > ago(30d)| where FileName =~ "lsass.exe"| where InitiatingProcessFileName !~ "wininit.exe"| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, AccountName, ProcessCommandLine| order by Timestamp desc

In a Memory Image

Volatility 3 reads a memory image, and each of its plugins below shows part of this sign.

• windows.pslist (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pslist means process list. Every copy of each name in the active list, with the session each runs in.
• windows.psscan (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. psscan means process scan. Process objects found by pool scan, exited and unlinked ones included. An exit time marks one that ended, so a copy without one needs explaining.
• windows.malware.psxview (documentation, opens in a new tab)Memory Image A Volatility 3 plugin from its malware group. It checks a memory image for code that hides, or code put into a process. psxview means process cross view. Each process with the four views that found it. Missing from the active list but found by the scans is the pattern to explain.
• windows.pstree (documentation, opens in a new tab)Memory Image A Volatility 3 plugin. It is one check run on a saved copy of a Windows machine's memory. pstree means process tree. Each copy's recorded parent. An lsass.exe under lsass.exe is a clone.

Rules to Compare With

Security vendors publish detection rules anyone can read. These look for the same thing, so compare your own with them.

How to Prevent It

Each control helps prevent it, and its line says what it does here.

• Added LSA protection (opens in a new tab) Runs lsass.exe as a protected process, which processes that are not protected cannot open to read its memory. Check it in the Registry: LSA Protection (RunAsPPL)
• Credential Guard (opens in a new tab) NTLM password hashes and Kerberos ticket-granting tickets move into LsaIso.exe, so a copy of lsass.exe's memory no longer holds them. Check it in the Registry: Credential Guard (LsaCfgFlags)
• ASR: Block credential stealing from the Windows local security authority subsystem (opens in a new tab) Defender locks down lsass.exe against credential theft where LSA protection is not on.

Related

Where It Matters Most

• System A second process named System, or a System whose PID is not 4.
• smss.exe A copy that is still running beside the first after its session is set up.
• csrss.exe More copies than the machine has sessions open.
• wininit.exe A second copy beside it, judged against the count on a clean machine of the same build.

See Them in the Tree

Travels with

• Unusual Start Time A second copy of a core process is a late one too, since it started after the copy Windows began at boot.

Read with Active Directory

• LSASS Memory Theft How credentials are read out of lsass.exe's memory, and what that leaves behind.

Sources

• Elastic: Potential LSASS Clone Creation via PssCaptureSnapShot (prebuilt rule) (opens in a new tab)
• Microsoft Learn: Service host grouping in Windows 10 (opens in a new tab)
• Microsoft Learn: Per-user services in Windows (opens in a new tab)
• Microsoft Tech Community (Ask the Performance Team): WS2008: Startup Processes and Delayed Automatic Start (each session's own csrss.exe and winlogon.exe) (opens in a new tab)
• Volatility 3: windows.malware.psxview (opens in a new tab)
• Volatility 3: windows.psscan (opens in a new tab)