Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe
Detects rundll32 invoking comsvcs.dll to dump lsass.exe via a MiniDump export.
- Product
- windows
- Category
- process_access
- Author
- Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
- Published
- 2020-10-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process access behavior where rundll32 loads comsvcs.dll and targets lsass.exe for a memory dump using the MiniDump export. Attackers may use this technique to extract credentials and secrets from the LSASS process while appearing as a legitimate system utility execution. The detection relies on process-access telemetry capturing the source process (rundll32), the target process (lsass.exe), and call-trace content indicating comsvcs.dll usage.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: rundll32 Triggering comsvcs.dll MiniDump Against lsass.exe"
id: 9629b4cb-aec9-48eb-82be-08e0810a853e
status: test
description: This rule flags process access behavior where rundll32 loads comsvcs.dll and targets lsass.exe for a memory dump using the MiniDump export. Attackers may use this technique to extract credentials and secrets from the LSASS process while appearing as a legitimate system utility execution. The detection relies on process-access telemetry capturing the source process (rundll32), the target process (lsass.exe), and call-trace content indicating comsvcs.dll usage.
references:
- https://twitter.com/shantanukhande/status/1229348874298388484
- https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-20
modified: 2023-11-29
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: \lsass.exe
SourceImage|endswith: \rundll32.exe
CallTrace|contains: comsvcs.dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a49fa4d5-11db-418c-8473-1e014a8dd462
type: derived