LSASS Process Reconnaissance via Findstr.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•12

Detects the execution of 'find.exe' or 'findstr.exe' with command-line arguments containing 'lsass'. This activity often indicates reconnaissance for the Local Security Authority Subsystem Service (LSASS) process ID, which is a common precursor to credential dumping attempts.