Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Live Memory Dump Using Powershell

Detects usage of a PowerShell command to dump the live memory of a Windows machine

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Max Altgelt (Nextron Systems)Created Tue Sep 21Updated Sun Dec 25cd185561-4760-45d6-a63e-a51325112caewindows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'Get-StorageDiagnosticInfo'
            - '-IncludeLiveDump'
    condition: selection
False Positives

Diagnostics

References
1
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Rule Metadata
Rule ID
cd185561-4760-45d6-a63e-a51325112cae
Status
test
Level
high
Type
Detection
Created
Tue Sep 21
Modified
Sun Dec 25
Author
Max Altgelt (Nextron Systems)
Path
rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml
Raw Tags
attack.credential-accessattack.t1003
View on GitHub