PowerShell Get-Process LSASS in ScriptBlock — Detection Rule

Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

Read the full analysis on IntelFusions