Credential Dumping Attempt Via Svchost
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Detection logic
selection
TargetImage|endswith: \svchost.exe
GrantedAccess: "0x143a"filter_main_known_processes
SourceImage|endswith:
- \services.exe
- \msiexec.exeCondition
selection and not 1 of filter_main_*Raw YAML
title: Credential Dumping Attempt Via Svchost
id: 174afcfa-6e40-4ae9-af64-496546389294
status: test
description: Detects when a process tries to access the memory of svchost to potentially dump credentials.
references:
- Internal Research
author: Florent Labouyrie
date: 2021-04-30
modified: 2022-10-09
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
product: windows
category: process_access
detection:
selection:
TargetImage|endswith: '\svchost.exe'
GrantedAccess: '0x143a'
filter_main_known_processes:
SourceImage|endswith:
- '\services.exe'
- '\msiexec.exe'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: highFalse positives
- Unknown
References
Internal Research