Windows PowerShell: Get-Process querying lsass within a ScriptBlock
Alerts when PowerShell ScriptBlock text runs Get-Process against lsass, a common credential-access precursor.
- Product
- windows
- Category
- ps_script
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-04-23
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell ScriptBlock content containing the specific command to query the lsass process via Get-Process. Accessing or enumerating LSASS is a common prerequisite for credential theft and is often indicative of malicious post-compromise activity. It relies on ScriptBlock Logging telemetry capturing the ScriptBlock text of PowerShell execution.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: Get-Process querying lsass within a ScriptBlock"
id: af42b045-1fba-49c8-8e45-77f403337f43
status: test
description: This rule flags PowerShell ScriptBlock content containing the specific command to query the lsass process via Get-Process. Accessing or enumerating LSASS is a common prerequisite for credential theft and is often indicative of malicious post-compromise activity. It relies on ScriptBlock Logging telemetry capturing the ScriptBlock text of PowerShell execution.
references:
- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-23
modified: 2022-12-25
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: Get-Process lsass
condition: selection
falsepositives:
- Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)
level: high
license: DRL-1.1
related:
- id: 84c174ab-d3ef-481f-9c86-a50d0b8e3edb
type: derived