lsassy LSASS Dump via rundll32 comsvcs.dll in Windows Temp (SMB/WMI/Task/DCOM)
Detects the remote execution of credential dumping activities via the lsassy tool. The rule identifies rundll32.exe being used to load comsvcs.dll for the purpose of creating a full MiniDump of the LSASS process memory. It specifically monitors for these actions occurring within common remote administrative execution contexts, such as SMB services, WMI, scheduled tasks, and DCOM, with output files staged in the Windows\Temp directory.
Microsoft Sentinel (KQL)
