Lsassy LSASS Dump via comsvcs.dll MiniDump across SMB/WMI/Task/DCOM

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects attempts to dump the memory of the Local Security Authority Subsystem Service (LSASS) process using the built-in Windows comsvcs.dll via rundll32.exe or tasklist commands, a common technique used for credential harvesting.