StrikeShark LSASS Dump and NTDS.dit Extraction via comsvcs.dll, ntdsutil, vssadmin

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects common credential dumping techniques targeting the LSASS process memory (using comsvcs.dll, procdump, or procdump64) and extraction of the Active Directory database (NTDS.dit) using ntdsutil, vssadmin, diskshadow, or esentutl. These activities are indicative of credential theft and domain-wide reconnaissance.