Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL

Extracting plaintext passwords, NTLM hashes, and Kerberos tickets directly from the Local Security Authority Subsystem Service (lsass.exe) is a core objective during post-exploitation. Instead of dropping detected binaries like mimikatz.exe, adversaries frequently exploit Living-off-the-Land Binaries (LOLBINs) such as rundll32.exe with comsvcs.dll, or legitimate administrator tools like Sysinternals procdump.exe.

Here is the exact KQL rule to intercept these credential access attempts.

Log Sources Required

• Microsoft Defender for Endpoint: DeviceProcessEvents & DeviceFileEvents

Sentinel / Defender Hunting Query

// Detect LSASS Process Memory Dumping Activity
let timeFrame = 7d;
DeviceProcessEvents
| where TimeGenerated >= ago(timeFrame)
| where 
    // Scenario 1: LOLBIN comsvcs.dll MiniDump export
    (FileName =~ "rundll32.exe" and ProcessCommandLine has_all ("comsvcs.dll", "MiniDump"))
    or
    // Scenario 2: ProcDump targeting LSASS
    (FileName in~ ("procdump.exe", "procdump64.exe") and ProcessCommandLine has "lsass")
    or
    // Scenario 3: Taskmgr creating LSASS dump via GUI/CLI
    (FileName =~ "taskmgr.exe" and ProcessCommandLine has "lsass")
    or
    // Scenario 4: Direct comsvcs ordinal execution (#24)
    (ProcessCommandLine has "comsvcs" and ProcessCommandLine has "#24")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessParentFileName, ReportId
| order by TimeGenerated desc

Correlating with Dump Files (DeviceFileEvents)

Adversaries dumping memory often write .dmp files to temporary or public directories:

DeviceFileEvents
| where TimeGenerated >= ago(24h)
| where FileName endswith ".dmp" or FileName endswith ".dump"
| where FolderPath has_any ("C:\\Windows\\Temp", "C:\\Temp", "C:\\Users\\Public")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName

Severity & Triage Guidance

• False Positive Probability: Near Zero for comsvcs.dll MiniDump. Legitimate enterprise software almost never exports memory dumps of LSASS using comsvcs. Treat any hit as a confirmed high-severity incident.
• Immediate Response: Isolate the target endpoint via Defender for Endpoint API, reset the compromised local/domain account passwords, and hunt for lateral movement from the host.

MITRE ATT&CK Mapping

• Tactic: Credential Access (TA0006)
• Technique: OS Credential Dumping: LSASS Memory (T1003.001)