LSASS Memory Dump for Credential Harvesting Prior to DCOM Lateral Movement

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•4

This rule detects attempts to dump LSASS process memory using common tools like procdump, rundll32 with comsvcs.dll, or mimikatz (sekurlsa module), followed by DCOM lateral movement (network connection on port 135) on the same device within a 30-minute window. This sequence of events is indicative of an adversary attempting to steal credentials and then use them for lateral movement within the network.