Windows Module Usage Enumeration via tasklist.exe -m rdpcorets.dll

title: Windows Module Usage Enumeration via tasklist.exe -m rdpcorets.dll
id: c8a18c13-4512-4ae0-a65f-3c88847f67fd
status: test
description: This rule detects when tasklist.exe is launched with module enumeration enabled (-m) and the command line references rdpcorets.dll. Attackers can use this to identify the specific process and PID that has a targeted DLL loaded, which can enable follow-on actions such as memory access or credential-related activity. The detection relies on Windows process creation telemetry, matching tasklist.exe execution and its command-line parameters.
references:
  - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
  - https://pentestlab.blog/tag/svchost/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-02-12
modified: 2024-03-13
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \tasklist.exe
    - OriginalFileName: tasklist.exe
  selection_flags:
    CommandLine|contains|windash: -m
  selection_module:
    CommandLine|contains: rdpcorets.dll
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f
    type: derived