Remote LSASS dump via rundll32 comsvcs.dll MiniDump (lsassy pattern)
Detects the use of rundll32.exe to execute the MiniDump command against comsvcs.dll, a known technique used to dump process memory (such as LSASS) to a file for credential harvesting.
Microsoft Sentinel (KQL)
