StrikeShark LSASS Memory Dumping via Pillager, procdump, or comsvcs MiniDump
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process to harvest credentials. This rule covers known credential dumping tools like Pillager and Procdump, the abuse of built-in Windows diagnostic tools like comsvcs.dll, and Mimikatz-style credential harvesting commands (e.g., sekurlsa). It also includes a generic detection for suspicious processes attempting to open a handle to lsass.exe.
Microsoft Sentinel (KQL)
