All Detections

Lsass Memory Dump via Comsvcs DLL

avatar
SigmaHQ Detections@sigmaHQ
updated Aug 12, 2024000

Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

Sigma