All Detections

PowerShell Get-Process LSASS in ScriptBlock

avatar
SigmaHQ Detections@sigmaHQ
updated Dec 25, 2022000

Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

Sigma