{"id":"8cde342c-ba48-4b74-b615-172c330f2e93","title":"Suspicious Renamed Comsvcs DLL Loaded By Rundll32","description":"Detects rundll32 loading a renamed comsvcs.dll to dump process memory","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-14","modified":"2023-02-17","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"product":"windows","category":"image_load"},"falsepositives":["Unlikely"],"references":["https://twitter.com/sbousseaden/status/1555200155351228419"],"source_path":"rules/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml","source_sha256":"f1832108161c1be4480a3ea0f63c7f0db14dd47b35823a86e327239ac6e328ed","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32\nid: 8cde342c-ba48-4b74-b615-172c330f2e93\nstatus: test\ndescription: Detects rundll32 loading a renamed comsvcs.dll to dump process memory\nreferences:\n    - https://twitter.com/sbousseaden/status/1555200155351228419\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-14\nmodified: 2023-02-17\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    product: windows\n    category: image_load\ndetection:\n    selection:\n        Image|endswith: '\\rundll32.exe'\n        Hashes|contains:\n            # Add more hashes for other windows versions\n            - IMPHASH=eed93054cb555f3de70eaa9787f32ebb # Windows 11 21H2 x64\n            - IMPHASH=5e0dbdec1fce52daae251a110b4f309d # Windows 10 1607\n            - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 # Windows 10 1809\n            - IMPHASH=407ca0f7b523319d758a40d7c0193699 # Windows 10 2004 x64\n            - IMPHASH=281d618f4e6271e527e6386ea6f748de # Windows 10 2004 x86\n    filter:\n        ImageLoaded|endswith: '\\comsvcs.dll'\n    condition: selection and not filter\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/8cde342c-ba48-4b74-b615-172c330f2e93.json","kind":"sigma"}