Windows RDP Credential Harvest via TermService Svchost Dump

Danny Y@zendannyy

•updated Jul 21, 2026•0•0•8

Detects credential dumping of the TermService svchost process that can retain plaintext RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port 3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or Sysinternals procdump. Correlate recon selections with a subsequent dump in the same session when possible.