PowerShell Get-Process LSASS

Title: PowerShell Get-Process LSASS
Status: test
Description:Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
References:
  -https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
Author: Florian Roth (Nextron Systems)
Date: 2021-04-23
modified:2023-01-05
Tags:

• -'attack.credential-access'
• -'attack.t1552.004'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'Get-Process lsas'
      -'ps lsas'
      -'gps lsas'

  condition:selection
Falsepositives:
  -Unknown
Level: high