Windows Process Memory Dump via comsvcs.dll using rundll32

title: Windows Process Memory Dump via comsvcs.dll using rundll32
id: ba2c0c1d-a0b5-4d47-897f-9cc302062434
related:
  - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c
    type: obsolete
  - id: 646ea171-dded-4578-8a4d-65e9822892e3
    type: derived
status: test
description: This rule flags Windows process executions where rundll32 loads comsvcs.dll to trigger a full process memory dump. Attackers use this technique to obtain sensitive in-memory data, supporting credential theft and other post-exploitation objectives. The detection relies on process creation telemetry, specifically the image name/original filename and command-line strings indicating comsvcs full dump behavior (including ordinal/function arguments).
references:
  - https://twitter.com/shantanukhande/status/1229348874298388484
  - https://twitter.com/pythonresponder/status/1385064506049630211?s=21
  - https://twitter.com/Hexacorn/status/1224848930795552769
  - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
  - https://twitter.com/SBousseaden/status/1167417096374050817
  - https://twitter.com/Wietze/status/1542107456507203586
  - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py
  - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml
author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2020-02-18
modified: 2025-02-23
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1036
  - attack.t1003.001
  - car.2013-05-009
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
    - CommandLine|contains: rundll32
  selection_cli_1:
    CommandLine|contains|all:
      - comsvcs
      - full
    CommandLine|contains:
      - "#-"
      - "#+"
      - "#24"
      - "24 "
      - MiniDump
      - "#65560"
  selection_generic:
    CommandLine|contains|all:
      - "24"
      - comsvcs
      - full
    CommandLine|contains:
      - " #"
      - ",#"
      - ", #"
      - '"#'
  condition: (selection_img and 1 of selection_cli_*) or selection_generic
falsepositives:
  - Unlikely
level: high
license: DRL-1.1