Rundll32 comsvcs.dll MiniDump used to dump LSASS memory

Renata Cardoso@rcardososec

•updated Aug 24, 2026•1•0•2

Detects the use of rundll32.exe to invoke the MiniDump function from comsvcs.dll, which is a well-known technique to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to a file for credential harvesting.