Tag
Detection of findstr or find commands that include the keyword lsass, which indicates reconnaissance activity for the LSASS process PID.