Avispa OrbitSOC
Detections your SOC lead approves.
Agents propose rules from intel, coverage gaps and threat profiles, and a SOC lead puts them live.
Proposed by the detection engineer agent
LSASS memory read by an unusual process
- Why this rule
- Intel
- Two articles this month describe credential theft from LSASS.
- Coverage
- Credential Access is your thinnest covered tactic.
- Telemetry
- Process-access events: ready on Windows.
- Confidence
- Medium
A SOC lead deploys it.
Write once, in Sigma.
Sigma
title: LSASS memory read by an unusual process
logsource:
product: windows
category: process_access
detection:
selection:
TargetImage|endswith: '\lsass.exe'
GrantedAccess|contains: '0x1010'
filter:
SourceImage|startswith: 'C:\Windows\System32\'
condition: selection and not filter
level: high
tags: [attack.credential_access, attack.t1003.001]Splunk SPL
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
EventCode=10 TargetImage="*\\lsass.exe"
GrantedAccess="*0x1010*"
NOT SourceImage="C:\\Windows\\System32\\*"Export forMicrosoft SentinelFalcon LogScaleGoogle SecOps
Library rules compile to Splunk SPL, and export for Microsoft Sentinel, Falcon LogScale and Google SecOps.
Every signal, remembered.
- 8Investigations
- 7Hunts
- 6Entities
- 5Documents
- 4Detections
- 3Lessons
- 2Facts
- 1Environment
Your organization
Lesson from an analyst
svc-reports signs in from RPT-SRV-02 at 01:00 UTC every night. That alone isn’t suspicious.
Reaches onlyTriage analystIdentity
Impact receipt once a SOC lead approves: Changed 3 investigations
| Investigation | What it saw | What changed |
|---|---|---|
| INV-2291 | svc-reports, 01:00 UTC, RPT-SRV-02 | Suspicious → benign |
| INV-2307 | svc-reports, 01:02 UTC, RPT-SRV-02 | Closed at triage |
| INV-2318 | svc-reports, 01:00 UTC, a new host | Still escalated |
Analysts teach lessons and the AI proposes facts, and a SOC lead approves what it keeps. Approved knowledge reaches only the agents it names, and receipts show what it changed.
No detection deploys itself, no knowledge goes live unapproved, and learning never rewrites a closed case.