Mimikatz LSASS Credential Dumping via Renamed Binaries and comsvcs MiniDump

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.