title: LSASS Memory Dump Via Comsvcs MiniDump
id: c53f8a78-5884-4fb2-a109-07c068fac9c5
status: experimental
description: |
  Detects rundll32 calling the MiniDump export of comsvcs.dll, the living-off-the-land route to
  an LSASS dump that needs no tooling on disk. The export can be called by ordinal (#24), so the
  rule matches the DLL name with either spelling of the export rather than the word alone.
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://lolbas-project.github.io/lolbas/Libraries/comsvcs/
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
  selection_dll:
    CommandLine|contains: 'comsvcs'
  selection_export:
    CommandLine|contains:
      - 'MiniDump'
      - '#24'
      - '#-4294967272'
  condition: all of selection_*
falsepositives:
  - None expected in production. A hit is either an intrusion or a red team, and both deserve a call.
level: critical