huntrule

Windows Process Memory Dump via comsvcs.dll using rundll32

Alert on rundll32 loading comsvcs.dll with arguments consistent with a full process memory dump.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2020-02-18
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process executions where rundll32 loads comsvcs.dll to trigger a full process memory dump. Attackers use this technique to obtain sensitive in-memory data, supporting credential theft and other post-exploitation objectives. The detection relies on process creation telemetry, specifically the image name/original filename and command-line strings indicating comsvcs full dump behavior (including ordinal/function arguments).

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange
Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps
Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping
Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line
Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches
Windows ProcDump renamed, copied or moved for stealth evasion
Windows Process Creation: createdump.exe Dumping Memory with Full and Name Flags
Windows Procdump Process Execution
Windows ProcDump Command Lines Targeting LSASS Memory Dumps
Malicious WDigest Credential Caching Enabled via Registry (via registry_set)
Windows Process Memory Dump via comsvcs.dll using rundll32
Pivot detection · T1003.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.