Suspicious Renamed Comsvcs DLL Loaded By Rundll32
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Sigma
