lsassy LSASS Dump via comsvcs.dll MiniDump and WmiPrvSE Execution
Detects the use of the built-in Windows rundll32.exe utility to call the MiniDump function within comsvcs.dll, a known technique for dumping the memory contents of the Local Security Authority Subsystem Service (LSASS). The rule specifically flags executions that write to the Windows\Temp directory, which is a common indicator of unauthorized credential harvesting attempts.
YARA-L
