Live Memory Dump Using Powershell

Title: Live Memory Dump Using Powershell
Status: test
Description:Detects usage of a PowerShell command to dump the live memory of a Windows machine
References:
  -https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps
Author: Max Altgelt (Nextron Systems)
Date: 2021-09-21
modified:2022-12-25
Tags:

• -'attack.credential-access'
• -'attack.t1003'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Get-StorageDiagnosticInfo'
      -'-IncludeLiveDump'

  condition:selection
Falsepositives:
  -Diagnostics
Level: high