LSASS Dump via comsvcs.dll and rundll32

Duo Tech@duotech

•updated Jun 16, 2026•1•0•13

Detects LSASS credential dumping using comsvcs.dll via rundll32, specifically looking for the ordinal 24 or the string "MiniDump" in the command line. This technique is commonly used by attackers for credential harvesting, especially after bypassing EDR solutions.