Process Memory Dump Via Comsvcs.DLL

SigmaHQ Detections@sigmaHQ

•updated Feb 25, 2025•2•0•32

Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.