PowerShell MiniDump Script

edit

This rule detects PowerShell scripts that have capabilities to dump process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access

Version: 1

Added (Elastic Stack release): 7.16.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

Powershell Scripts that use this capability for troubleshooting.

Rule query

edit
event.code:"4104" and
powershell.file.script_block_text:(MiniDumpWriteDump or
MiniDumpWithFullMemory or pmuDetirWpmuDiniM)

Threat mapping

edit

Framework: MITRE ATT&CKTM