LSASS dump via rundll32 comsvcs.dll MiniDump (lsassy-style)
Detects the use of rundll32.exe to execute comsvcs.dll's MiniDump functionality against the LSASS process, a common technique for dumping credentials. The rule includes behavioral correlation by identifying the same user account executing this pattern on multiple devices within a one-hour window.
Microsoft Sentinel (KQL)
