Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.

FreeReviewedSigma · High · v2

Product: windows
Category: ps_script
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-04-23
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell ScriptBlock content containing the specific command to query the lsass process via Get-Process. Accessing or enumerating LSASS is a common prerequisite for credential theft and is often indicative of malicious post-compromise activity. It relies on ScriptBlock Logging telemetry capturing the ScriptBlock text of PowerShell execution.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows PowerShell: Get-Process querying lsass within a ScriptBlock

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-scriptblock-get-process-targeting-lsass-84c174ab

title: "Windows PowerShell: Get-Process querying lsass within a ScriptBlock"
id: af42b045-1fba-49c8-8e45-77f403337f43
status: test
description: This rule flags PowerShell ScriptBlock content containing the specific command to query the lsass process via Get-Process. Accessing or enumerating LSASS is a common prerequisite for credential theft and is often indicative of malicious post-compromise activity. It relies on ScriptBlock Logging telemetry capturing the ScriptBlock text of PowerShell execution.
references:
  - https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-23
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Get-Process lsass
  condition: selection
falsepositives:
  - Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)
level: high
license: DRL-1.1
related:
  - id: 84c174ab-d3ef-481f-9c86-a50d0b8e3edb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL