Lsassy LSASS Dump via rundll32/comsvcs.dll MiniDump (SMB/WMI/Task/DCOM)
Detects attempts to perform credential dumping from the LSASS process memory using the built-in Windows binary rundll32.exe to execute comsvcs.dll. The rule monitors for specific command-line arguments and common output file paths associated with manual dumping or automated tools like lsassy.
Cortex XDR
