PowerShell credential dumping
A PowerShell script block containing the API calls or tool names used to extract credentials from memory.
What it detects
A PowerShell script block containing the API calls or tool names used to extract credentials from memory. Script-block logging (4104) records the DECODED text of what PowerShell actually ran, after any encoding or obfuscation layer has been unwrapped — so this sees the real payload even when the command line was -EncodedCommand or a compressed blob.
MiniDumpWriteDump is the API every in-memory LSASS dumper ultimately calls; reflective callers reach it through System.Management.Automation or a direct dbghelp.dll P/Invoke, which is why the API name rather than a tool name is the primary signal.
MITRE ATT&CK mapping
False positives and triage
A security team's own scripts, a red-team exercise, or a detection-engineering test can contain these names legitimately — and so, occasionally, can a blog post pasted into a console by an administrator who was reading it.
To confirm: read the surrounding script block, which is in the event. Establish who ran it and whether an authorised exercise was under way at that time. If it was not, treat every account that had a session on the host as compromised and rotate it, and preserve the script text — this event is often the only place the payload exists in readable form, since the file on disk is routinely deleted afterwards.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/powershell_credential_dumping.yaml, licensed under the Apache License 2.0.
id: windows.credential.powershell_credential_dumping
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1003.001, T1059.001]
description: |
A PowerShell script block containing the API calls or tool names used to extract
credentials from memory. Script-block logging (4104) records the DECODED text of
what PowerShell actually ran, after any encoding or obfuscation layer has been
unwrapped — so this sees the real payload even when the command line was
`-EncodedCommand` or a compressed blob.
`MiniDumpWriteDump` is the API every in-memory LSASS dumper ultimately calls;
reflective callers reach it through `System.Management.Automation` or a direct
`dbghelp.dll` P/Invoke, which is why the API name rather than a tool name is the
primary signal.
match:
event_action: script_executed
command_line_contains_any:
- 'MiniDumpWriteDump'
- 'MiniDumpWithFullMemory'
- 'Out-Minidump'
- 'Invoke-Mimikatz'
- 'sekurlsa'
- 'lsadump'
- 'Invoke-NinjaCopy'
- 'Get-KeePassDatabaseKey'
- 'Invoke-DCSync'
- 'Get-PassHashes'
- 'Invoke-PowerDump'
- 'DumpCreds'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
A security team's own scripts, a red-team exercise, or a detection-engineering
test can contain these names legitimately — and so, occasionally, can a blog post
pasted into a console by an administrator who was reading it.
To confirm: read the surrounding script block, which is in the event. Establish who
ran it and whether an authorised exercise was under way at that time. If it was
not, treat every account that had a session on the host as compromised and rotate
it, and preserve the script text — this event is often the only place the payload
exists in readable form, since the file on disk is routinely deleted afterwards.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.