credential_access_suspicious_comsvcs_imageload.toml

[metadata]
creation_date = "2021/10/17"
updated_date = "2022/02/16"
maturity = "production"


[rule]
author = ["Elastic"]
description = """
Identifies suspicious renamed COMSVCS.DLL Image Load, which exports the MiniDump function that can be used to dump a
process memory. This may indicate an attempt to dump LSASS memory while bypassing command-line based detection in
preparation for credential access.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-windows.*"]
language = "eql"
license = "Elastic License v2"
name = "Potential Credential Access via Renamed COM+ Services DLL"
note = """## Config

You will need to enable logging of ImageLoads in your Sysmon configuration to include COMSVCS.DLL by Imphash or Original
File Name."""
references = ["https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/"]
risk_score = 73
rule_id = "c5c9f591-d111-4cf8-baec-c26a39bc31ef"
severity = "high"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Credential Access"]
timestamp_override = "event.ingested"
type = "eql"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.category == "process" and
    process.name : "rundll32.exe"]
 [process where event.category == "process" and event.dataset : "windows.sysmon_operational" and event.code == "7" and
   (file.pe.original_file_name : "COMSVCS.DLL" or file.pe.imphash : "EADBCCBB324829ACB5F2BBE87E5549A8") and
    /* renamed COMSVCS */
    not file.name : "COMSVCS.DLL"]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
reference = "https://attack.mitre.org/techniques/T1003/"
id = "T1003"
name = "OS Credential Dumping"
[[rule.threat.technique.subtechnique]]
reference = "https://attack.mitre.org/techniques/T1003/001/"
id = "T1003.001"
name = "LSASS Memory"



[rule.threat.tactic]
reference = "https://attack.mitre.org/tactics/TA0006/"
id = "TA0006"
name = "Credential Access"