Windows PowerShell ScriptBlock Get-Process Targeting lsass

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

FreeUnreviewedSigmahighv1

windows-powershell-scriptblock-get-process-targeting-lsass-84c174ab

title: Windows PowerShell ScriptBlock Get-Process Targeting lsass
id: af42b045-1fba-49c8-8e45-77f403337f43
status: test
description: This rule flags PowerShell ScriptBlock content that includes a Get-Process call targeting the lsass process. Accessing or enumerating LSASS is a common step in credential access workflows, so repeated or unexpected activity can indicate malicious intent. It relies on Script Block logging telemetry capturing the ScriptBlock text.
references:
  - https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-23
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Get-Process lsass
  condition: selection
falsepositives:
  - Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)
level: high
license: DRL-1.1
related:
  - id: 84c174ab-d3ef-481f-9c86-a50d0b8e3edb
    type: derived

What it detects

This rule flags PowerShell ScriptBlock content that includes a Get-Process call targeting the lsass process. Accessing or enumerating LSASS is a common step in credential access workflows, so repeated or unexpected activity can indicate malicious intent. It relies on Script Block logging telemetry capturing the ScriptBlock text.

Known false positives

Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.