Hrushikesh Badgujar
@H3ADCompletionist
1 follower0 downloads24 copies0 likes2,433 views
16 detections
Filters
Last updated
All Time
Detection languages
16
Categories
6
4
2
2
2
Platforms
16
6
6
Products / Services
4
2
MITRE Techniques
6
2
2
2
2
LSASS Dump via comsvcs.dll MiniDump
Cortex XDR
This hunt detects potential credential dumping activity leveraging rundll32.exe to invoke the MiniDump function from comsvcs.dll, a known technique used to dump the memory of sensitive processes like LSASS.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
This hunt identifies potential credential dumping activity by detecting known dump tools such as procdump.exe, rundll32.exe, and taskmgr.exe creating memory dump files (.dmp) in suspicious or attacker-preferred directories.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
LSASS Dump via comsvcs.dll MiniDump
Cortex XDR
This hunt detects potential credential dumping activity leveraging rundll32.exe to invoke the MiniDump function from comsvcs.dll, a known technique used to dump the memory of sensitive processes like LSASS.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory).
The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
This hunt identifies potential credential dumping activity by detecting known dump tools such as procdump.exe, rundll32.exe, and taskmgr.exe creating memory dump files (.dmp) in suspicious or attacker-preferred directories.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
Adversaries often store LSASS dumps in locations like:
- Temp directories
- ProgramData
- Public folders
These paths are commonly used because they are writable, less monitored, and blend in with normal system activity. The presence of dump files in these locations, especially when created by known dumping tools, it is a strong indicator of malicious credential access attempts.
This detection identifies potential persistence and execution activity associated with a supply chain compromise involving a malicious npm package
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Page 2 of 2