{"id":"cd185561-4760-45d6-a63e-a51325112cae","title":"Live Memory Dump Using Powershell","description":"Detects usage of a PowerShell command to dump the live memory of a Windows machine","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2021-09-21","modified":"2022-12-25","tags":["attack.credential-access","attack.t1003"],"technique_ids":["T1003"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Diagnostics"],"references":["https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml","source_sha256":"5fb929549f8dfe51853af1290a3d8bcd43aa482c17c19d0b4c00195aa9245204","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Live Memory Dump Using Powershell\nid: cd185561-4760-45d6-a63e-a51325112cae\nstatus: test\ndescription: Detects usage of a PowerShell command to dump the live memory of a Windows machine\nreferences:\n    - https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps\nauthor: Max Altgelt (Nextron Systems)\ndate: 2021-09-21\nmodified: 2022-12-25\ntags:\n    - attack.credential-access\n    - attack.t1003\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - 'Get-StorageDiagnosticInfo'\n            - '-IncludeLiveDump'\n    condition: selection\nfalsepositives:\n    - Diagnostics\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/cd185561-4760-45d6-a63e-a51325112cae.json","kind":"sigma"}