PowerShell Live Memory Dump via Get-StorageDiagnosticInfo with -IncludeLiveDump (Windows)

title: PowerShell Live Memory Dump via Get-StorageDiagnosticInfo with -IncludeLiveDump (Windows)
id: a29aee8a-dd12-4f82-bd10-c4f4f9c34b1b
status: test
description: This rule flags PowerShell script content that invokes Get-StorageDiagnosticInfo with the -IncludeLiveDump parameter, which requests a live memory dump from a Windows machine. Attackers can use live dump capabilities to extract sensitive material such as credentials from memory. Detection relies on PowerShell Script Block Logging telemetry that captures the executed command text.
references:
  - https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2021-09-21
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.t1003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Get-StorageDiagnosticInfo
      - -IncludeLiveDump
  condition: selection
falsepositives:
  - Diagnostics
level: high
license: DRL-1.1
related:
  - id: cd185561-4760-45d6-a63e-a51325112cae
    type: derived