detection.wiki

Detection rules › Sigma

Loaded Module Enumeration Via Tasklist.EXE

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel
Source
github.com/SigmaHQ/sigma

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Loaded Module Enumeration Via Tasklist.EXE
id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f
status: test
description: |
    Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
    This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
    In order to dump the process memory or perform other nefarious actions.
references:
    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
    - https://pentestlab.blog/tag/svchost/
author: Swachchhanda Shrawan Poudel
date: 2024-02-12
modified: 2024-03-13
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\tasklist.exe'
        - OriginalFileName: 'tasklist.exe'
    selection_flags:
        CommandLine|contains|windash: '-m'
    selection_module:
        # Note: add other interesting modules or binaries
        CommandLine|contains: 'rdpcorets.dll'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\tasklist.exe'
    - OriginalFileName: 'tasklist.exe'

Stage 2: selection_flags

selection_flags:
    CommandLine|contains|windash: '-m'

Stage 3: selection_module

selection_module:
    CommandLine|contains: 'rdpcorets.dll'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -m transforms: windash corpus 2 (sigma 2)
  • rdpcorets.dll
Imageends_with
  • \tasklist.exe corpus 5 (sigma 5)
OriginalFileNameeq
  • tasklist.exe corpus 4 (sigma 3, elastic 1)