Possible Loaded Module Enumeration Through Tasklist.EXE (via process_creation)

title: Possible Loaded Module Enumeration Through Tasklist.EXE (via process_creation)
id: 549d2b13-4897-558a-b80e-07a244ecce95
status: stable
description: This rule detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is frequently used by adversaries to find the specific process identifier (PID) that is using the DLL in question. To dump the process memory or perform other nefarious actions.
references:
    - https://attack.mitre.org/techniques/T1003/
    - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
    - https://pentestlab.blog/tag/svchost/
author: Huntrule Team
date: 2026-06-16
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\tasklist.exe'
        - OriginalFileName: 'tasklist.exe'
    selection_flags:
        CommandLine|contains|windash: '-m'
    selection_module:
        CommandLine|contains: 'rdpcorets.dll'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium