LSASS memory dump via rundll32.exe comsvcs.dll MiniDump
Detects the use of rundll32.exe to invoke the MiniDump export function within comsvcs.dll against the lsass.exe process. This technique is commonly used by attackers to dump credential material from memory for offline analysis and credential harvesting.
Microsoft Sentinel (KQL)
