PowerShell Get-Process LSASS in ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the execution of a PowerShell command containing 'Get-Process lsass' within a script block. This command is commonly used by attackers to identify the LSASS process ID before attempting to dump its memory for credential harvesting. The detection relies on PowerShell Script Block Logging being enabled.