Detection of PowerShell Get-Process Execution on LSASS

Monitoring for the execution of PowerShell cmdlets targeting the Local Security Authority Subsystem Service (LSASS) process is a critical detection capability for identifying credential access activities. Attackers often leverage built-in PowerShell commands like Get-Process (or its aliases 'ps' and 'gps') to enumerate the LSASS process handle or existence within a compromised environment. While these cmdlets can be used for administrative purposes, their application against LSASS is highly anomalous and frequently serves as a reconnaissance step before attempting to access LSASS memory to extract credentials (e.g., via tools like Mimikatz). Defenders should establish baseline activity for administrative scripts and alert on direct PowerShell interactions with this critical system process.

Impact

Successful reconnaissance of the LSASS process is often the first stage in credential theft campaigns. Unauthorized access to LSASS memory allows attackers to extract cleartext passwords, NTLM hashes, and Kerberos tickets, which facilitates lateral movement, privilege escalation, and persistent access to the enterprise domain.

Recommendation

Deploy the provided Sigma rule to your SIEM environment to detect enumeration of the LSASS process via PowerShell. Ensure that PowerShell script block logging (Event ID 4104) and process creation events (Sysmon Event ID 1) are enabled to capture these command lines. Investigate any instances where administrative service accounts or user accounts execute these commands against LSASS, as they likely indicate credential access attempts.