Process Memory Dump Via Comsvcs.DLL

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Process Memory Dump Via Comsvcs.DLL
id: 646ea171-dded-4578-8a4d-65e9822892e3
related:
    - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c
      type: obsolete
status: test
description: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
references:
    - https://twitter.com/shantanukhande/status/1229348874298388484
    - https://twitter.com/pythonresponder/status/1385064506049630211?s=21
    - https://twitter.com/Hexacorn/status/1224848930795552769
    - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
    - https://twitter.com/SBousseaden/status/1167417096374050817
    - https://twitter.com/Wietze/status/1542107456507203586
    - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py
    - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2020-02-18
modified: 2025-02-23
tags:
    - attack.credential-access
    - attack.stealth
    - attack.t1036
    - attack.t1003.001
    - car.2013-05-009
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
        - CommandLine|contains: 'rundll32'
    selection_cli_1:
        CommandLine|contains|all:
            - 'comsvcs'
            - 'full'
        CommandLine|contains:
            - '#-'
            - '#+'
            - '#24'
            - '24 '
            - 'MiniDump' # Matches MiniDump and MinidumpW
            - '#65560' # ordinal is 16 bit ordinal, so if you make the number large enough (don't fit in 16 bit space), then it normally wraps around.  for e.g ordinal 24 can be also represented by 65560 (65536+24)
    selection_generic:
        CommandLine|contains|all:
            - '24'
            - 'comsvcs'
            - 'full'
        CommandLine|contains:
            - ' #'
            - ',#'
            - ', #'
            - '"#'
    condition: (selection_img and 1 of selection_cli_*) or selection_generic
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

(selection_img and 1 of selection_cli_*) or selection_generic

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
    - CommandLine|contains: 'rundll32'

Stage 2: `selection_cli_1`

selection_cli_1:
    CommandLine|contains|all:
        - 'comsvcs'
        - 'full'
    CommandLine|contains:
        - '#-'
        - '#+'
        - '#24'
        - '24 '
        - 'MiniDump'
        - '#65560'

Stage 3: `selection_generic`

selection_generic:
    CommandLine|contains|all:
        - '24'
        - 'comsvcs'
        - 'full'
    CommandLine|contains:
        - ' #'
        - ',#'
        - ', #'
        - '"#'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`#` corpus 2 (sigma 1, chronicle 1) `"#` `#+` corpus 4 (sigma 3, chronicle 1) `#-` corpus 4 (sigma 3, chronicle 1) `#24` corpus 2 (sigma 1, chronicle 1) `#65560` `, #` corpus 3 (sigma 2, chronicle 1) `,#` corpus 3 (sigma 2, chronicle 1) `24` corpus 2 (sigma 1, chronicle 1) `24` `MiniDump` corpus 5 (sigma 4, chronicle 1) `comsvcs` corpus 3 (sigma 2, chronicle 1) `full` corpus 3 (sigma 2, chronicle 1) `rundll32` corpus 26 (sigma 23, chronicle 2, kusto 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`OriginalFileName`	eq	`RUNDLL32.EXE` corpus 78 (sigma 35, elastic 22, splunk 21)	`field:"OriginalFileName" kind:eq value:"RUNDLL32.EXE"`

Process Memory Dump Via Comsvcs.DLL

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_1

Stage 3: selection_generic

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli_1`

Stage 3: `selection_generic`