huntrule

Windows PowerShell Get-Process or aliases targeting LSASS (lsas)

Alerts on PowerShell Get-Process/alias commands referencing LSASS in Windows process creation events.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-04-23
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation command lines that include PowerShell Get-Process activity (or its aliases) referencing the LSASS process string. Attackers often enumerate LSASS to support credential access or other post-exploitation steps. It relies on Windows process creation telemetry and matches command-line substrings corresponding to Get-Process variants targeting lsas.

Reporting behind it

Related detections9 linkedT1552.004 — drag to rearrange
Suspicious Process Memory Read from Proc Mem for Secret Extraction
Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)
Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)
Suspicious macOS Local Credential Validation via dscl authonly
Suspicious Credential File Harvesting of NPM Claude and SSH Secrets
Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)
Suspicious Credential File Discovery via Find on Linux
Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)
Windows File Writes Matching DPAPI Backup Key and Certificate Export Filenames
Windows PowerShell Get-Process or aliases targeting LSASS (lsas)
Pivot detection · T1552.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.