PowerShell MiniDump Scriptedit

This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.

Rule type: query

Rule indices:

  • winlogbeat-*
  • logs-windows.*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Credential Access
  • Investigation Guide

Version: 102 (version history)

Added (Elastic Stack release): 7.16.0

Last modified (Elastic Stack release): 8.6.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positivesedit

PowerShell scripts that use this capability for troubleshooting.

Investigation guideedit

## Triage and analysis

### Investigating PowerShell MiniDump Script

PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This
makes it available for use in various environments, and creates an attractive way for attackers to execute code.

Attackers can abuse Process Memory Dump capabilities to extract credentials from LSASS or to obtain other
privileged information stored in the process memory.

#### Possible investigation steps

- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration
capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for
prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
- Examine file or network events from the involved PowerShell process for suspicious behavior.
- Investigate other alerts associated with the user/host during the past 48 hours.
- Evaluate whether the user needs to use PowerShell to complete tasks.
- Check if the imported function was executed and which process it targeted.

### False positive analysis

- Regular users do not have a business justification for using scripting utilities to dump process memory, making false
positives unlikely.

### Related rules

- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d

### Response and remediation

- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved hosts to prevent further post-compromise behavior.
- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business
systems, and web services.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
mean time to respond (MTTR).

Rule queryedit

event.category:process and
powershell.file.script_block_text:(MiniDumpWriteDump or
MiniDumpWithFullMemory or pmuDetirWpmuDiniM)

Threat mappingedit

Framework: MITRE ATT&CKTM

Rule version historyedit

Version 102 (8.6.0 release)
  • Formatting only
Version 101 (8.5.0 release)
  • Formatting only
Version 9 (8.4.0 release)
  • Formatting only
Version 7 (8.3.0 release)
  • Formatting only
Version 6 (8.2.0 release)
  • Formatting only
Version 5 (8.1.0 release)
  • Formatting only
Version 3 (8.0.0 release)
  • Updated query, changed from:

    event.code:"4104" and
    powershell.file.script_block_text:(MiniDumpWriteDump or
    MiniDumpWithFullMemory or pmuDetirWpmuDiniM)