Akira lsassy LSASS dump via rundll32 comsvcs.dll MiniDump
Detects the use of rundll32.exe to execute the MiniDump function of comsvcs.dll, a known technique for dumping the memory of the Local Security Authority Subsystem Service (LSASS) process to gain access to stored credentials.
Splunk (SPL)
