0

Is there any legitimate reason why Jenkins would ever need to request the memory of c:\windows\system32\lsass.exe (Local Security Authority Subsystem Service)?

The endpoint protection (Carbon Black) on the Jenkins server is denying Jenkins access to lsass.exe, and the devs are unable to tell me why their favorite automation tool needs to do an activity that is highly suspicious in terms of security.

MITRE ATT&CK

I was hoping that the community could help me here. I have no direct access to the Jenkins device, I only see suspicious events being reported by the endpoint security software.

Improve this question
4
  • Have you contacted Jenkins support? Asked the support forums or community? Their Discord channel?
    – schroeder ♦
    Aug 17 at 11:38
  • I have asked on the Jenkins mailing list, that's their official community support channel listed on the Jenkins website. Jenkins does not have a Discord mentioned on their website. They do have IRC though. I'm repeating my question there but given previous experiences with IRC, I don't have high hopes.
    – Amedee Van Gasse
    Aug 17 at 11:40
  • ... on modern Windows that usually won't even work; LSASS runs in a mostly-isolated VM specifically to prevent programs (such as Cain & Abel) from accessing its address space. Even without that, though, it would require full admin/SYSTEM privileges (which Jenkins shouldn't have). This doesn't make any sense as something that Jenkins would try to do legitimately. Which suggests the worrying possibility that your Jenkins install might be compromised.
    – CBHacking
    Aug 17 at 12:17
  • I know, right? It's a Windows Server 2019, one of the modern Windowses where it won't work, and Carbon Black is already intercepting the memory access before it can reach the operating system (and be denied by the operating system). I'll check if Jenkins is running with SYSTEM privileges.
    – Amedee Van Gasse
    Aug 17 at 14:06

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .