All Detections

PowerShell Get-Process LSASS

avatar
SigmaHQ Detections@sigmaHQ
updated Jan 5, 2023000

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Sigma