Windows Process Access: rundll32 comsvcs.dll MiniDump to Dump lsass.exe

title: "Windows Process Access: rundll32 comsvcs.dll MiniDump to Dump lsass.exe"
id: 9629b4cb-aec9-48eb-82be-08e0810a853e
status: test
description: This rule flags process access activity where rundll32.exe invokes comsvcs.dll to perform a MiniDump-style operation targeting lsass.exe. Attackers use this technique to obtain credentials and secrets from memory without dropping obvious dump utilities. The detection relies on telemetry that captures the target process name, the invoking binary, and a call trace indicating comsvcs.dll.
references:
  - https://twitter.com/shantanukhande/status/1229348874298388484
  - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-20
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|endswith: \rundll32.exe
    CallTrace|contains: comsvcs.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a49fa4d5-11db-418c-8473-1e014a8dd462
    type: derived