StrikeShark LSASS Memory Dump via Pillager, comsvcs.dll, or procdump

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects techniques used to perform credential dumping from the LSASS process memory, including the use of comsvcs.dll via rundll32, the procdump utility, and unauthorized process handle requests (OpenProcess) targeting lsass.exe.