high
advisory
LSASS Process Reconnaissance Via Findstr.EXE
Detection of findstr or find commands that include the keyword lsass, which indicates reconnaissance activity for the LSASS process PID.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:50 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
Detection coverage 1
LSASS Process Reconnaissance Via Findstr.EXE
highDetects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID
sigma
sources: process_creation, windows
Detection queries are available on the platform. Get full rules →