Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Credential Dumping Attempt Via Svchost

Detects when a process tries to access the memory of svchost to potentially dump credentials.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florent LabouyrieCreated Fri Apr 30Updated Sun Oct 09174afcfa-6e40-4ae9-af64-496546389294windows
Log Source
WindowsProcess Access
ProductWindows← raw: windows
CategoryProcess Access← raw: process_access

Events when a process opens a handle to another process, commonly used for credential dumping via LSASS.

Detection Logic
Detection Logic2 selectors
detection:
    selection:
        TargetImage|endswith: '\svchost.exe'
        GrantedAccess: '0x143a'
    filter_main_known_processes:
        SourceImage|endswith:
            - '\services.exe'
            - '\msiexec.exe'
    condition: selection and not 1 of filter_main_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
Internal Research
MITRE ATT&CK
Rule Metadata
Rule ID
174afcfa-6e40-4ae9-af64-496546389294
Status
test
Level
high
Type
Detection
Created
Fri Apr 30
Modified
Sun Oct 09
Author
Florent Labouyrie
Path
rules/windows/process_access/proc_access_win_svchost_credential_dumping.yml
Raw Tags
attack.defense-evasionattack.privilege-escalationattack.t1548
View on GitHub