PowerShell Live Kernel Dump

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell scripts or commands that create live kernel dumps. While live kernel dumps are a legitimate diagnostic mechanism, they are increasingly abused by threat actors to read sensitive process memory such as LSASS without opening a direct process handle, bypassing traditional process-access based detections.

2026-08-10 00:00:00

None

b8f1e3c2-d4a7-4b9e-8c5d-2f3a1b0e7d6c

attack.credential-access attack.t1003.001

Nextron Sigma feed only (private)