{"id":"646ea171-dded-4578-8a4d-65e9822892e3","title":"Process Memory Dump Via Comsvcs.DLL","description":"Detects a process memory dump via \"comsvcs.dll\" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)","author":"Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2020-02-18","modified":"2025-02-23","tags":["attack.credential-access","attack.stealth","attack.t1036","attack.t1003.001","car.2013-05-009"],"technique_ids":["T1003.001","T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://twitter.com/shantanukhande/status/1229348874298388484","https://twitter.com/pythonresponder/status/1385064506049630211?s=21","https://twitter.com/Hexacorn/status/1224848930795552769","https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/","https://twitter.com/SBousseaden/status/1167417096374050817","https://twitter.com/Wietze/status/1542107456507203586","https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py","https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml","source_sha256":"9859aead00dd5cb94933434be60a0727f436fcc6886bf00fde69440f5a3e483f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Process Memory Dump Via Comsvcs.DLL\nid: 646ea171-dded-4578-8a4d-65e9822892e3\nrelated:\n    - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c\n      type: obsolete\nstatus: test\ndescription: Detects a process memory dump via \"comsvcs.dll\" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)\nreferences:\n    - https://twitter.com/shantanukhande/status/1229348874298388484\n    - https://twitter.com/pythonresponder/status/1385064506049630211?s=21\n    - https://twitter.com/Hexacorn/status/1224848930795552769\n    - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/\n    - https://twitter.com/SBousseaden/status/1167417096374050817\n    - https://twitter.com/Wietze/status/1542107456507203586\n    - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py\n    - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s\nauthor: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2020-02-18\nmodified: 2025-02-23\ntags:\n    - attack.credential-access\n    - attack.stealth\n    - attack.t1036\n    - attack.t1003.001\n    - car.2013-05-009\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n        - CommandLine|contains: 'rundll32'\n    selection_cli_1:\n        CommandLine|contains|all:\n            - 'comsvcs'\n            - 'full'\n        CommandLine|contains:\n            - '#-'\n            - '#+'\n            - '#24'\n            - '24 '\n            - 'MiniDump' # Matches MiniDump and MinidumpW\n            - '#65560' # ordinal is 16 bit ordinal, so if you make the number large enough (don't fit in 16 bit space), then it normally wraps around.  for e.g ordinal 24 can be also represented by 65560 (65536+24)\n    selection_generic:\n        CommandLine|contains|all:\n            - '24'\n            - 'comsvcs'\n            - 'full'\n        CommandLine|contains:\n            - ' #'\n            - ',#'\n            - ', #'\n            - '\"#'\n    condition: (selection_img and 1 of selection_cli_*) or selection_generic\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"},{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/646ea171-dded-4578-8a4d-65e9822892e3.json","kind":"sigma"}