Detectionhightest

PowerShell Get-Process LSASS in ScriptBlock

Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Fri Apr 23Updated Sun Dec 2584c174ab-d3ef-481f-9c86-a50d0b8e3edbwindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        ScriptBlockText|contains: 'Get-Process lsass'
    condition: selection

False Positives

Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable)

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

84c174ab-d3ef-481f-9c86-a50d0b8e3edb

Status

test

Level

high

Type

Detection

Created

Fri Apr 23

Modified

Sun Dec 25

Author

Path

rules/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml

Raw Tags

attack.credential-accessattack.t1003.001