KQL Search

This query is designed to detect potentially malicious activities related to credential dumping on a Windows system. Here's a simplified explanation:

1. Purpose: The query aims to identify suspicious uses of the rundll32.exe process, which is a legitimate Windows utility that can be exploited by attackers to execute malicious code.

2. Techniques Detected:

   • System Binary Proxy Execution (T1218.011): This involves using legitimate system binaries, like rundll32.exe, to execute malicious code.
   • OS Credential Dumping (T1003): This is a technique used by attackers to extract credentials from the operating system, often targeting the LSASS (Local Security Authority Subsystem Service) process.
   • Defense Evasion (TA0005) and Credential Access (TA0006): These are broader tactics that include avoiding detection and gaining access to credentials, respectively.

3. Detection Method:

   • The query looks for rundll32.exe being executed with certain patterns in its command line arguments. These patterns include obfuscated ordinal numbers (e.g., #+, #-, #0, #655, #656) that can indicate an attempt to hide malicious activity.
   • It also checks for rundll32.exe trying to perform a memory dump of the comsvcs process, which is a known method for extracting credentials from LSASS.

4. Risk: This activity is particularly concerning if Credential Guard, a security feature that helps protect credentials, is not active on the system.

5. Author and References: The query was created by Benjamin Zulliger, and it builds on work by Ayush Anand, as detailed on the Security in Bits website.

In summary, this query helps security analysts detect potential credential dumping attempts using rundll32.exe in a way that tries to evade detection by using obfuscation techniques.