iMHLv2

rule GenericPowershell 
{
    strings:
        $a = "PS>function"
        $b = "Invoke-Expression"
        $c = "<MS><S N="
        $d = "</MS></Obj>"
        $e = "CompileAssemblyFromSource"
        $f = "Remoting.RemoteHostMethodId"
        $g = "<resp:Arguments"

iMHLv2

@staticmethod
def shimcache_xp(address_space):
    """Enumerate entries from the shared memory section 
    on XP systems."""

    seen = []
    shim = lambda x : (x.Tag == "Vad " and 
                              x.VadFlags.Protection == 4)

    for process in tasks.pslist(address_space):

iMHLv2

# Get the Win10 branch of Volatility 

git clone -b win10tp https://github.com/volatilityfoundation/volatility.git 

# Get the memory dump 

https://www.sendspace.com/pro/dl/0cte2h

# Run some commands