|
| 1 | +REQUIRED |
| 2 | + |
| 3 | +-m {*|region|referenced|ioc} |
| 4 | +-p {*|PID} |
| 5 | + |
| 6 | +OPTIONAL |
| 7 | + |
| 8 | +-v {detail|debug|surface} |
| 9 | +-d |
| 10 | +--option {from-base|statistics} |
| 11 | +--filter {unsigned-module|clr-prvx|clr-heap|metadata-modules} |
| 12 | +--address <memory address> |
| 13 | +--region-size <memory region size> |
| 14 | + |
| 15 | + |
| 16 | +-m The memory to select and apply scanner settings to. |
| 17 | + |
| 18 | + * Select all regions of committed memory. |
| 19 | + ioc Select only regions which have suspicions associated with them. |
| 20 | + region Select only the region(s) which overlap with the region provided |
| 21 | + through the --address and --region-size arguments. |
| 22 | + referenced Select only regions which are referenced within the region(s) |
| 23 | + associated with the provided --address and --region-size arguments |
| 24 | +-p The process(es) to scan. In the event that * is used, all accessible processes will |
| 25 | + be enumerated and scanned. |
| 26 | +--option Additional actions to optionally apply to the memory selected from the scan. |
| 27 | + |
| 28 | + from-base All subregions associated with the allocation bases of all |
| 29 | + selected memory will also be selected. |
| 30 | + statistics Calculate permission statistics on the selected memory after a |
| 31 | + scan has completed. |
| 32 | +-d Dump all selected memory to the local file system after each process scan is complete. |
| 33 | +--address A memory address in 0x* format to be used in conjunction with either the "region" or |
| 34 | + "referenced" selection types. |
| 35 | +--region-size Optionally specify the size of the region of the provided "--address." The default is |
| 36 | + a region size of 0. |
| 37 | +-v The verbosity level with which to print information related to the selected memory. |
| 38 | + The default is "surface" |
| 39 | +--filter The filters to apply when eliminating suspicions associated with selected memory. |
| 40 | + |
| 41 | + * Apply all filters. Only malware and unknown false positives shown. |
| 42 | + unsigned-module Regions of image memory associated with unsigned PE files. |
| 43 | + metadata-modules Regions of image memory stemming from signed Windows metadata PE |
| 44 | + files on disk. |
| 45 | + clr-heap Native executable heaps created during CLR initialization. |
| 46 | + clr-prvx Managed heaps associated with active CLR heaps and JIT code. |
| 47 | + wow64-init IOCs resulting from Wow64 process initialization such as certain |
| 48 | + modified system library code sections |
0 commit comments