Credential Dumping via comsvcs.dll MiniDump rundll32 (T1003.001)
Detects the use of rundll32.exe to execute the MiniDump function of comsvcs.dll to create a memory dump of the Local Security Authority Subsystem Service (LSASS). This technique is commonly used by adversaries to extract credential materials from LSASS memory.
SentinelOne
