kqlElastic-2.0from elastic/detection-rules

PowerShell MiniDump Script

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1003 T1003.001 T1059 T1059.001

Rule sourcerules/windows/credential_access_posh_minidump.toml

event.category:process and host.os.type:windows and powershell.file.script_block_text:(MiniDumpWriteDump or MiniDumpWithFullMemory or pmuDetirWpmuDiniM) and not user.id : "S-1-5-18"