LSASS Memory Dump via Comsvcs DLL and Rundll32

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•0•39

This rule detects attempts to dump the Local Security Authority Subsystem Service (LSASS) memory using `rundll32.exe` to call the `MiniDump` export function from `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from a compromised system.