{"id":"34275eb8-fa19-436b-b959-3d9ecd53fa1f","title":"Loaded Module Enumeration Via Tasklist.EXE","description":"Detects the enumeration of a specific DLL or EXE being used by a binary via \"tasklist.exe\".\nThis is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.\nIn order to dump the process memory or perform other nefarious actions.\n","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2024-02-12","modified":"2024-03-13","tags":["attack.t1003","attack.credential-access"],"technique_ids":["T1003"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/","https://pentestlab.blog/tag/svchost/"],"source_path":"rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml","source_sha256":"446d0872d22f4261360a8858301775ac80532afedcd0bdb9e6a408a7c003532c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Loaded Module Enumeration Via Tasklist.EXE\nid: 34275eb8-fa19-436b-b959-3d9ecd53fa1f\nstatus: test\ndescription: |\n    Detects the enumeration of a specific DLL or EXE being used by a binary via \"tasklist.exe\".\n    This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.\n    In order to dump the process memory or perform other nefarious actions.\nreferences:\n    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/\n    - https://pentestlab.blog/tag/svchost/\nauthor: Swachchhanda Shrawan Poudel\ndate: 2024-02-12\nmodified: 2024-03-13\ntags:\n    - attack.t1003\n    - attack.credential-access\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '\\tasklist.exe'\n        - OriginalFileName: 'tasklist.exe'\n    selection_flags:\n        CommandLine|contains|windash: '-m'\n    selection_module:\n        # Note: add other interesting modules or binaries\n        CommandLine|contains: 'rdpcorets.dll'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/34275eb8-fa19-436b-b959-3d9ecd53fa1f.json","kind":"sigma"}