LOLBAS/yml/OSLibraries/comsvcs.yml

---
Name: Comsvcs.dll
Description: COM+ Services
Author: LOLBAS Team
Created: 2019-08-30
Commands:
  - Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump [LSASS_PID] dump.bin full
    Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.
    Usecase: Dump Lsass.exe process memory to retrieve credentials.
    Category: Dump
    Privileges: SYSTEM
    MitreID: T1003.001
    OperatingSystem: Windows 10, Windows 11
Full_Path:
  - Path: c:\windows\system32\comsvcs.dll
Code_Sample:
  - Code: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Detection:
  - Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml
  - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml
  - Elastic: https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml
  - Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
Resources:
  - Link: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Acknowledgement:
  - Person: modexp
    Handle:
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`---`
			`Name: Comsvcs.dll`
			`Description: COM+ Services`
Adding missing authors 2022-09-11 05:37:10 +02:00			`Author: LOLBAS Team`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Created: 2019-08-30`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Commands:`
Remove redundant powershell command from comsvcs entry 2022-05-05 12:16:19 +02:00			`- Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump [LSASS_PID] dump.bin full`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump.`
Adjusted case sensitive type in yml file for Comsvcs 2019-09-16 09:44:14 +02:00			`Usecase: Dump Lsass.exe process memory to retrieve credentials.`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Category: Dump`
			`Privileges: SYSTEM`
LSASS realign to T1003.001 2021-11-05 21:35:58 +01:00			`MitreID: T1003.001`
Adding more missed-out entries 2021-12-15 12:46:04 +01:00			`OperatingSystem: Windows 10, Windows 11`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Full_Path:`
			`- Path: c:\windows\system32\comsvcs.dll`
			`Code_Sample:`
			`- Code: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/`
			`Detection:`
$frack113$ Update old sigma link (#303) * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> 2023-10-18 17:30:34 +02:00			`- Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml`
			`- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml`
Detection Resources and Other Updates (#179) * Add detection links for scripts * Add detection links for OtherMSBins. Fixed and updated as needed. * Add detection links for MSBins. Fixed and updated as needed. * Add detection links for oslibraries * Updating template for Detections * Removing empty Detection:Sigma entries * Remove redundant blank line * Replacing commit URL with file URL Co-authored-by: root <root@DESKTOP-5CR935D.localdomain> Co-authored-by: Wietze <wietze@users.noreply.github.com> 2021-11-15 14:19:03 +01:00			`- Elastic: https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/credential_access_cmdline_dump_tool.toml`
			`- Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/dump_lsass_via_comsvcs_dll.yml`
Add Comsvcs.yml: dump lsass via signed DLL. 2019-08-30 14:12:46 +02:00			`Resources:`
			`- Link: https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/`
Fixed some typos 2019-09-17 20:45:49 +02:00			`Acknowledgement:`
Acknowledgement fix for comsvcs 2019-09-16 09:50:01 +02:00			`- Person: modexp`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Handle:`