Loaded Module Enumeration Via Tasklist.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•14

Detects the enumeration of loaded modules or DLLs within processes using 'tasklist.exe' with the '-m' flag. This activity is often performed by attackers to identify the Process ID (PID) associated with a specific DLL (e.g., 'rdpcorets.dll') for subsequent actions like dumping process memory to extract credentials.