huntrule

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

FreeUnreviewedSigmahighv1
title: Windows PowerShell Get-Process or aliases targeting LSASS (lsas)
id: 409b0d15-7868-42aa-84eb-4bfc43aa78fa
status: test
description: This rule flags process creation command lines that include PowerShell Get-Process activity (or its aliases) referencing the LSASS process string. Attackers often enumerate LSASS to support credential access or other post-exploitation steps. It relies on Windows process creation telemetry and matches command-line substrings corresponding to Get-Process variants targeting lsas.
references:
  - https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_getprocess_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-23
modified: 2023-01-05
tags:
  - attack.credential-access
  - attack.t1552.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - Get-Process lsas
      - ps lsas
      - gps lsas
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b2815d0d-7481-4bf0-9b6c-a4c48a94b349
    type: derived

What it detects

This rule flags process creation command lines that include PowerShell Get-Process activity (or its aliases) referencing the LSASS process string. Attackers often enumerate LSASS to support credential access or other post-exploitation steps. It relies on Windows process creation telemetry and matches command-line substrings corresponding to Get-Process variants targeting lsas.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.