Native LSASS Memory Dumping: Detecting Comsvcs.dll and Process Handle Abuse

The Local Security Authority Subsystem Service (lsass.exe) enforces security policy on Windows operating systems, verifies user logins, and stores sensitive security material, including Kerberos tickets, NTLM password hashes, and cleartext credentials in memory. While tools such as Mimikatz historically extracted this data directly, modern Endpoint Detection and Response (EDR) sensors reliably detect custom dumping executables based on static signatures.

To avoid signature detection, adversaries turn to built-in system components that export memory dumping capabilities. The most prevalent technique abuses comsvcs.dll, an official Microsoft COM+ Services library, via rundll32.exe.

The comsvcs.dll MiniDump execution vector

Comsvcs.dll exports an API wrapper function named MiniDump. Adversaries invoke this function through rundll32 by supplying the process ID (PID) of lsass.exe, an output file path, and the dump type flag:

rundll32.exe C:\windows\system32\comsvcs.dll, MiniDump <LSASS_PID> C:\temp\lsass.dmp full

To find the PID of lsass.exe dynamically, attackers chain this command with tasklist or PowerShell:

powershell -c "$p=(Get-Process lsass).Id; rundll32.exe comsvcs.dll, MiniDump $p C:\Users\Public\lsass.dmp full"

When executed with administrative or SYSTEM privileges, comsvcs.dll calls the MiniDumpWriteDump function in Dbghelp.dll. The function opens a handle to the lsass.exe process, reads its virtual memory space, and writes the contents to the designated dump file. The attacker transfers this dump file off the host and parses credentials offline.

Telemetry analysis: Process creation and Sysmon Event ID 10

Detecting comsvcs.dll memory dumping involves two distinct telemetry points:

First, command-line auditing (Windows Event 4688 / Sysmon Event 1) captures rundll32 referencing comsvcs.dll and the MiniDump export. Because legitimate software almost never invokes MiniDump via rundll32, any occurrence of this command line warrants an immediate security alert.

Second, Sysmon Event ID 10 (ProcessAccess) monitors when one process opens a handle to another. When MiniDump executes, rundll32 requests specific access rights to lsass.exe:

• TargetImage: C:\Windows\system32\lsass.exe
• GrantedAccess: 0x1010 (PROCESS_VM_READ | PROCESS_QUERY_LIMITED_INFORMATION) or 0x1FFFFF (PROCESS_ALL_ACCESS).
• CallTrace: Contains references to dbghelp.dll or comsvcs.dll.

Correlating an anomalous handle opening to lsass.exe from an unexpected source binary provides high-fidelity detection even when an attacker renames comsvcs.dll or executes the API call from custom in-memory shellcode.

KQL detection query for Microsoft Sentinel

This query detects comsvcs.dll MiniDump execution via process creation telemetry and flags file creation events with .dmp extensions:

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName =~ "rundll32.exe" or FileName =~ "rundll32.exe"
| where ProcessCommandLine has "comsvcs" and ProcessCommandLine has "MiniDump"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName

Splunk SPL search for Sysmon process access

Search for untrusted processes requesting memory read access to lsass.exe:

index=windows EventCode=10 TargetImage="*\lsass.exe"
(GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1FFFFF")
NOT SourceImage IN ("*\MsMpEng.exe", "*\csrss.exe", "*\services.exe")
| table _time, host, SourceImage, TargetImage, GrantedAccess, CallTrace

Mitigation and credential protection

Enable Windows Defender Credential Guard, which uses virtualization-based security (VBS) to isolate LSASS secrets in a protected virtual machine container inaccessible to standard kernel processes. In addition, enable LSA Protection (RunAsPPL), which prevents non-protected processes from opening read handles to lsass.exe.

Learn more in our Credential Dump category, review MITRE ATT&CK T1003 OS Credential Dumping, and inspect pre-built queries in our KQL catalog and Splunk rules.

For API specifications, review Microsoft Learn MiniDumpWriteDump Function Documentation and MITRE ATT&CK T1003.001 (LSASS Memory).