huntrule

Windows: Rundll32 Loads Renamed comsvcs.dll for Process Memory Dump

Flags rundll32.exe loading a renamed comsvcs.dll module consistent with process memory dumping behavior on Windows.

FreeUnreviewedSigmahighv1
title: "Windows: Rundll32 Loads Renamed comsvcs.dll for Process Memory Dump"
id: 66481754-e18c-4d5a-a2bd-33d4a845c74c
status: test
description: This rule identifies rundll32.exe performing an image load of a comsvcs.dll module whose filename is ending with \comsvcs.dll, while the loaded module does not match the expected benign case implied by the filter. Attackers commonly abuse rundll32 with renamed DLLs to access process memory and facilitate credential dumping. Telemetry required is Windows image load events that include the loading process image path and the loaded module path, with IMPHASH-based matching for rundll32.
references:
  - https://twitter.com/sbousseaden/status/1555200155351228419
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
modified: 2023-02-17
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \rundll32.exe
    Hashes|contains:
      - IMPHASH=eed93054cb555f3de70eaa9787f32ebb
      - IMPHASH=5e0dbdec1fce52daae251a110b4f309d
      - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8
      - IMPHASH=407ca0f7b523319d758a40d7c0193699
      - IMPHASH=281d618f4e6271e527e6386ea6f748de
  filter:
    ImageLoaded|endswith: \comsvcs.dll
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 8cde342c-ba48-4b74-b615-172c330f2e93
    type: derived

What it detects

This rule identifies rundll32.exe performing an image load of a comsvcs.dll module whose filename is ending with \comsvcs.dll, while the loaded module does not match the expected benign case implied by the filter. Attackers commonly abuse rundll32 with renamed DLLs to access process memory and facilitate credential dumping. Telemetry required is Windows image load events that include the loading process image path and the loaded module path, with IMPHASH-based matching for rundll32.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.