SystemBC LSASS Credential Dump via procdump or comsvcs.dll MiniDump

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized access to the LSASS process memory, a common technique for credential harvesting. The rule monitors for the execution of 'procdump.exe' or 'rundll32.exe' with parameters specifically aimed at creating a memory dump of 'lsass.exe', behaviors commonly associated with the SystemBC post-exploitation framework.