StrikeShark Pillager LSASS Credential Dumping via comsvcs MiniDump or procdump

Ibrahim Saud@tektrix

•updated Jun 28, 2026•1•0•3

Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.