Windows rundll32 Loading Renamed comsvcs.dll via DLL Image Load

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags executions where rundll32.exe loads a DLL image that ends with \comsvcs.dll when the loaded image is not an expected comsvcs.dll location/pattern. Loading comsvcs.dll through rundll32 is a common technique attackers use to access memory-related capabilities under a living-off-the-land binary. It relies on Windows image-load telemetry that records the launching Image and the ImageLoaded path, along with matching IMPHASH values for rundll32.exe.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows rundll32 Loading Renamed comsvcs.dll via DLL Image Load

Pivot detection · T1003.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rundll32-loads-renamed-comsvcs-dll-for-process-memory-dump-8cde342c

title: Windows rundll32 Loading Renamed comsvcs.dll via DLL Image Load
id: 66481754-e18c-4d5a-a2bd-33d4a845c74c
status: test
description: This rule flags executions where rundll32.exe loads a DLL image that ends with \comsvcs.dll when the loaded image is not an expected comsvcs.dll location/pattern. Loading comsvcs.dll through rundll32 is a common technique attackers use to access memory-related capabilities under a living-off-the-land binary. It relies on Windows image-load telemetry that records the launching Image and the ImageLoaded path, along with matching IMPHASH values for rundll32.exe.
references:
  - https://twitter.com/sbousseaden/status/1555200155351228419
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
modified: 2023-02-17
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \rundll32.exe
    Hashes|contains:
      - IMPHASH=eed93054cb555f3de70eaa9787f32ebb
      - IMPHASH=5e0dbdec1fce52daae251a110b4f309d
      - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8
      - IMPHASH=407ca0f7b523319d758a40d7c0193699
      - IMPHASH=281d618f4e6271e527e6386ea6f748de
  filter:
    ImageLoaded|endswith: \comsvcs.dll
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 8cde342c-ba48-4b74-b615-172c330f2e93
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL