All Detections

LSASS Process Reconnaissance Via Findstr.EXE

avatar
SigmaHQ Detections@sigmaHQ
updated Nov 26, 2025000

Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Sigma