Windows Process Access to svchost.exe for Credential Dumping Attempts

Alerts on attempts to read svchost.exe memory consistent with credential dumping, excluding known benign callers.

FreeUnreviewedSigmahighv1

windows-process-access-to-svchost-exe-for-credential-dumping-attempts-174afcfa

title: Windows Process Access to svchost.exe for Credential Dumping Attempts
id: a5de070c-a544-4e1c-a247-522074a77c71
status: test
description: This rule flags process access operations targeting svchost.exe with a specific granted access value associated with credential dumping behavior. Attackers may use memory access to extract credentials from a running Windows service host process. The detection relies on Windows process-access telemetry that includes the target image path and the granted access mask, and it excludes access originating from services.exe or msiexec.exe to reduce common benign activity.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_svchost_credential_dumping.yml
author: Florent Labouyrie, Huntrule Team
date: 2021-04-30
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: windows
  category: process_access
detection:
  selection:
    TargetImage|endswith: \svchost.exe
    GrantedAccess: "0x143a"
  filter_main_known_processes:
    SourceImage|endswith:
      - \services.exe
      - \msiexec.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 174afcfa-6e40-4ae9-af64-496546389294
    type: derived

What it detects

This rule flags process access operations targeting svchost.exe with a specific granted access value associated with credential dumping behavior. Attackers may use memory access to extract credentials from a running Windows service host process. The detection relies on Windows process-access telemetry that includes the target image path and the granted access mask, and it excludes access originating from services.exe or msiexec.exe to reduce common benign activity.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.