PowerShell MiniDump Scriptedit

This rule detects PowerShell scripts that have capabilities to dump process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100



  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access

Version: 1

Added (Elastic Stack release): 7.16.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positivesedit

Powershell Scripts that use this capability for troubleshooting.

Rule queryedit

event.code:"4104" and
powershell.file.script_block_text:(MiniDumpWriteDump or
MiniDumpWithFullMemory or pmuDetirWpmuDiniM)

Threat mappingedit