Lsass Memory Dump via Comsvcs DLL

Google SecOps@GoogleSecOps

•updated Jun 6, 2025•2•0•1

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass