Detection rules › Sigma

Loaded Module Enumeration Via Tasklist.EXE

Severity
medium
Author
Swachchhanda Shrawan Poudel
Source
upstream

Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_img

or:
Image|endswith: '\tasklist.exe'
OriginalFileName: tasklist.exe

Stage 2: all of selection_flags

CommandLine|contains: -m

Stage 3: all of selection_module

CommandLine|contains: rdpcorets.dll

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -m
  • rdpcorets.dll
Imageends_with
  • \tasklist.exe corpus 4 (sigma 4)
OriginalFileNameeq
  • tasklist.exe corpus 2 (sigma 2)