Mimikatz LSASS Credential Dump via sekurlsa, procdump, or comsvcs MiniDump

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•5

This rule detects techniques commonly used by attackers to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. It monitors for the execution of known Mimikatz binaries or the use of specific Mimikatz command-line arguments, the execution of legitimate tools like Procdump to dump LSASS memory, the misuse of rundll32 with comsvcs.dll to perform a memory dump, and the creation of files named lsass.dmp, which are common artifacts of credential dumping activities.