Credential Dumping Attempt Via Svchost

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•15

This rule detects attempts by a process to access the memory of 'svchost.exe' with a specific access right ('0x143a'), which is indicative of a credential dumping attempt. The rule filters out legitimate access from 'services.exe' and 'msiexec.exe' to reduce false positives.