PowerShell Remote Thread Creation into LSASS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.