LSASS Dump via comsvcs.dll MiniDump
This hunt detects potential credential dumping activity leveraging rundll32.exe to invoke the MiniDump function from comsvcs.dll, a known technique used to dump the memory of sensitive processes like LSASS. Attackers abuse this method because it uses legitimate Windows binaries (Living-off-the-Land Binaries - LOLBins), making detection harder. This behavior is strongly associated with credential access techniques such as MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory). The presence of comsvcs.dll combined with MiniDump in the command line is a high-fidelity indicator of suspicious or malicious activity, often used by red teams and real-world adversaries.
Cortex XDR
