Donato Di Sapia
@avqdonato0 followers0 downloads20 copies1 like557 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
This rule detects suspicious execution patterns of rundll32.exe. Specifically, it looks for rundll32.exe being called with an obfuscated ordinal number (e.g., #+, #-, #0, #655, #656) which can be used by adversaries to obscure malicious code. Additionally, it identifies rundll32.exe attempting to perform a MiniDump of the 'comsvcs' process, which is a common technique for OS credential dumping.
this query combines Queries in a single Query created from Ayush Anand and published on https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/
this query combines Queries in a single Query created from Ayush Anand and published on https://www.securityinbits.com/detection-engineering/lsass-dump-comsvcs-rundll32/
