Home / Stories / Topic

Credential Dumping

Topic • 1 Story

Related: KQL Cloud Security Azure DevSecOps Entra ID Microsoft Sentinel AI Security Threat Hunting

Dikshant Lather · Sep 25, 2026

Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL

Detect credential theft targeting the Local Security Authority Subsystem Service (LSASS) via native LOLBINs like comsvcs.dll and Sysinternals ProcDump in KQL.

Endpoint Detection 2 min read

0 0

Spotting LSASS Memory Dumping via Comsvcs.dll and Procdump in KQL