My First Sigma Detection Rule: LSASS Access

Detects Powershell.exe or cmd.exe accessing lsass.exe with full or near full access rights.