LSASS Memory Access/Dump via ProcDump, comsvcs.dll, or High-Risk GrantedAccess

Ibrahim Saud@tektrix

•updated 16 days ago•0•0•0

Detects processes opening lsass.exe with high-risk access rights consistent with credential dumping (Sysmon EventID 10), including known dumping tool patterns such as procdump or rundll32 invoking the comsvcs.dll MiniDump export.