Loaded Module Enumeration Via Tasklist.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Loaded Module Enumeration Via Tasklist.EXE
id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f
status: test
description: |
    Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
    This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
    In order to dump the process memory or perform other nefarious actions.
references:
    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
    - https://pentestlab.blog/tag/svchost/
author: Swachchhanda Shrawan Poudel
date: 2024-02-12
modified: 2024-03-13
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\tasklist.exe'
        - OriginalFileName: 'tasklist.exe'
    selection_flags:
        CommandLine|contains|windash: '-m'
    selection_module:
        # Note: add other interesting modules or binaries
        CommandLine|contains: 'rdpcorets.dll'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\tasklist.exe'
    - OriginalFileName: 'tasklist.exe'

Stage 2: `selection_flags`

selection_flags:
    CommandLine|contains|windash: '-m'

Stage 3: `selection_module`

selection_module:
    CommandLine|contains: 'rdpcorets.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-m` transforms: `windash` corpus 2 (sigma 2) `rdpcorets.dll`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\tasklist.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\tasklist.exe"`
`OriginalFileName`	eq	`tasklist.exe` corpus 4 (sigma 3, elastic 1)	`field:"OriginalFileName" kind:eq value:"tasklist.exe"`