Threat Hunting Exercise: Analyzing Windows LSASS Memory Dump via comsvcs.dll MiniDump Dataset
This hunt uses a simulated EDR/Sysmon dataset (windows_lsass_comsvcs_2022-08-08T151000.json) capturing T1003.001: OS Credential Dumping (LSASS Memory), where an attacker abuses the built-in comsvcs.dll MiniDump export via rundll32.exe to dump LSASS memory without dropping a known offensive tool binary, evading signature-based detection.
Step 1: Hypothesis Formation
Hypothesis: rundll32.exe is launched with command-line arguments invoking comsvcs.dll,MiniDump targeting the LSASS process ID, writing a .dmp file to disk - a living-off-the-land technique for credential dumping that requires no additional tooling. Indicators:
- Process creation:
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> <path>.dmp full. - A handle is opened to
lsass.exewithPROCESS_VM_READaccess immediately before the dump file is written. - The resulting
.dmpfile is written to an unusual location (temp directory, world-writable folder) rather than a standard crash-dump path. - The parent process of
rundll32.exeis a script host, remote-access tool, or command shell rather than Explorer or a legitimate installer.
Null Hypothesis: A legitimate crash-dump or diagnostic collection tool is generating an LSASS minidump for a genuine troubleshooting case (e.g., Microsoft-supplied ProcDump run by IT support under a documented ticket). Invalidate by confirming no support ticket references LSASS troubleshooting and that rundll32.exe (not procdump.exe) is the invoking binary.
Rationale: Because comsvcs.dll is a native, digitally-signed Windows DLL, this technique frequently evades AV signatures that only flag known dumping tools like Mimikatz or ProcDump - this hunt validates process-argument and handle-access based detection as a signature-independent control.
Step 2: Data Sources and Scope
- Sources: Sysmon Event ID 1 (Process Creation) and 10 (Process Access); EDR file-write telemetry; Windows Security Event 4688 (process creation with command line auditing).
- Scope: ~2022-08-08T15:10:00-15:11:30 UTC; Host: SRV-WEB-012 (10.160.3.44); Parent process chain:
w3wp.exe→cmd.exe→rundll32.exe. - SIEM Queries (Splunk/ELK):
index=sysmon EventCode=1 CommandLine="comsvcs.dllMiniDump*" | table _time Computer ParentImage CommandLine- Process access to LSASS:
index=sysmon EventCode=10 TargetImage="lsass.exe" GrantedAccess="0x1410" | table _time Computer SourceImage - Suspicious dump file writes:
index=edr file_path=".dmp" NOT file_path="C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\"
Step 3: Key Findings
Parsed events (5 shown) confirm rundll32.exe, spawned from a compromised IIS worker process, dumped LSASS to a temp folder using the comsvcs.dll technique.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? | |
|---|---|---|---|---|---|
| 2022-08-08 15:10:02 | SRV-WEB-012 | Sysmon 1 - Process Create | w3wp.exe spawns cmd.exe /c whoami & tasklist | Web-shell IOC: IIS worker process spawning a shell is a classic post-web-shell-upload indicator, preceding the credential-dumping attempt. | |
| 2022-08-08 15:10:41 | SRV-WEB-012 | Sysmon 1 - Process Create | cmd.exe spawns rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 812 C:\Windows\Temp\update.dmp full | LOLBIN IOC: signed, native DLL invoked to dump PID 812 (lsass.exe) - no external tool required, evading tool-signature AV rules. | |
| 2022-08-08 15:10:42 | SRV-WEB-012 | Sysmon 10 - Process Access | rundll32.exe opens lsass.exe with GrantedAccess 0x1410 (PROCESS_VM_READ \ | PROCESS_QUERY_INFORMATION) | Handle-access IOC: this specific access mask on lsass.exe is a strong, tool-agnostic credential-dumping signal. |
| 2022-08-08 15:10:43 | SRV-WEB-012 | File write | C:\Windows\Temp\update.dmp (167 MB) created | Location IOC: legitimate LSASS crash dumps never land in C:\Windows\Temp; the filename mimics a benign update artifact. | |
| 2022-08-08 15:11:20 | SRV-WEB-012 | Network | Outbound SMB/HTTP transfer of update.dmp to 203.0.113.77 | Exfil IOC: the dump was staged and immediately transferred off-host for offline parsing (Mimikatz sekurlsa::minidump). |
Validation:
- Timeline: web-shell command execution, LSASS dump via comsvcs.dll, and exfiltration all within 90 seconds - a tight, automated attack chain.
- False Positives: no IT ticket or scheduled diagnostic job references LSASS on SRV-WEB-012; the process lineage originates from a web application process, not an administrative tool.
- Correlation: process-access mask, file-write location, and exfiltration destination together leave no plausible benign explanation.
Step 4: Recommendations & Next Steps
- Immediate Response: Isolate SRV-WEB-012; force domain-wide credential reset for all accounts with recent interactive or service logons on that host; remove the underlying web shell; block 203.0.113.77 at the perimeter.
- Detection: Sigma-style rule:
title: LSASS Dump via comsvcs.dll→selection: Image="rundll32.exe" AND CommandLine="comsvcs.dllMiniDump*". - Pro Tip: Enable Credential Guard and configure LSASS as a Protected Process Light (PPL) - this blocks even signed-binary dumping techniques like comsvcs.dll from successfully reading LSASS memory, regardless of the invoking process.
Hypothesis confirmed - an attacker used the built-in comsvcs.dll MiniDump technique via rundll32.exe to dump LSASS credentials following a web shell compromise, then exfiltrated the dump for offline parsing!