Process Memory Dump via Comsvcs.DLL using Rundll32
This rule detects attempts to dump process memory, specifically targeting the Local Security Authority Subsystem Service (LSASS) process, using `rundll32.exe` and `comsvcs.dll`. This technique is commonly used by adversaries to extract credentials from memory. The rule looks for `rundll32.exe` executing with `comsvcs.dll` and specific keywords like 'full', 'minidump', or numerical arguments (e.g., '24', '#-') that indicate a memory dump operation.
YARA-L
