Loaded Module Enumeration Via Tasklist.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\tasklist.exe" OR ORIGINALFILENAME = "tasklist.exe") AND COMMANDLINE contains "-m,/m,–m,—m,―m" AND COMMANDLINE contains "rdpcorets.dll" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Swachchhanda Shrawan Poudel
