Live Memory Dump Using PowerShell Get-StorageDiagnosticInfo

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•14

Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.