LSASS Credential Dumping via ProcDump/Comsvcs MiniDump

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•3

Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) process using well-known utilities such as procdump, rundll32 with comsvcs.dll, and taskmgr, which are frequently used by adversaries to perform credential dumping.