HuntCONSTRUCTED

Hunt: rundll32 calling the comsvcs MiniDump export

Finds LSASS dumps taken with a DLL that ships in System32, whether the export is named or called by ordinal. One idea in three query languages, each bounded to seven days.

Credential AccessT1003.001checked 2026-09-21

Needs

Process creation with full command line: Sysmon event 1, Security 4688 with command-line auditing, or an EDR's process table
Seven days of retention on that source, or the hunt is looking at less than it says

Will also return

Nothing legitimate is expected. A hit is an intrusion, a red team, or a colleague testing a detection, and all three are worth a conversation.
The string comsvcs on its own appears in COM+ administration. It is the MiniDump export, by name or by ordinal, that makes it a finding.

What it looks for

comsvcs.dll exports a function called MiniDump, and rundll32 will call it for anybody with the privileges to open LSASS. Nothing has to be brought onto the host, which is why the technique outlived the tools it replaced.

The export can be called by ordinal instead of by name: #24, or its signed 32-bit form. Operators use the ordinal because rules match the word. All three variants below match the DLL together with any of the three spellings.

If it returns something

One row is enough. Take the host and the time, and go to the first-15-minutes checklist for an LSASS dump, which starts with not logging on to that host with a privileged account.

The guided lab works the same technique from the Sysmon side, where event 10 and its access mask settle what the command line can only suggest.

If it returns nothing

Check that it could have. An empty result from a source with no command-line logging, or with three days of retention against a seven-day window, is a finding about telemetry and says nothing about the estate.

All three variants are marked untested: they were written from the documented field names and have not been run against a live SIEM. The same logic, as a Sigma rule that does pass sigma check, is in the endpoint pack.

KQL

Microsoft Defender XDRUntestedwindow: 7 days, set in the query

Uses contains rather than has. has matches whole terms, and the hash sign in #24 is a term delimiter, so has would never match the ordinal.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "rundll32.exe" or ProcessVersionInfoOriginalFileName =~ "RUNDLL32.EXE"
| where ProcessCommandLine contains "comsvcs"
| where ProcessCommandLine contains "MiniDump"
    or ProcessCommandLine contains "#24"
    or ProcessCommandLine contains "#-4294967272"
| project Timestamp, DeviceName, AccountDomain, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
| order by Timestamp desc

SPL

Splunk with SysmonUntestedwindow: 7 days, set with earliest

The index and sourcetype are the common defaults for the Splunk Add-on for Sysmon. Yours will differ: change them before you run it, not after it returns nothing.

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-7d@d
  (Image="*\\rundll32.exe" OR OriginalFileName="RUNDLL32.EXE")
  CommandLine="*comsvcs*"
  (CommandLine="*MiniDump*" OR CommandLine="*#24*" OR CommandLine="*#-4294967272*")
| table _time host User CommandLine ParentImage ParentCommandLine
| sort - _time

Elastic

EQL, Elastic Defend or Winlogbeat with SysmonUntestedwindow: 7 days, set in the time picker

The colon operator is a case-insensitive wildcard match in EQL, which is what makes the list on the last line work.

process where event.type == "start" and
  (process.name : "rundll32.exe" or process.pe.original_file_name : "RUNDLL32.EXE") and
  process.command_line : "*comsvcs*" and
  process.command_line : ("*MiniDump*", "*#24*", "*#-4294967272*")

sources

Tags: hunting · lsass · credential-access · lolbin · sysmon · defender-xdr · splunk · elastic · T1003.001 · microsoft