Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Behaviour (ATT&CK technique)

LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

AQLhighconfidence 90/100generated 2026-10-18

A process invokes the MiniDump export of comsvcs.dll (rundll32 comsvcs.dll, MiniDump / Observed for: APT1, APT15, APT27, APT28, APT3, APT32 and 35 more.

ATT&CK
T1003.001 mitre ↗
Linked actors
APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · APT33 · APT35 · APT39 · APT40 · APT5 · Blue Mockingbird · Cleaver · Earth Kapre · Earth Lusca · FIN13 · FIN6 · FIN8 · Fox Kitten · GALLIUM · HAFNIUM · INDRIK SPIDER · Kimsuky · Lazarus Group · Medusa Group · MirrorFace · MuddyWater · OilRig · Pink Sandstorm · PLATINUM · play · RASPITE · SaintBear · Sandworm · Silence group · Tick · UNC3886 · Void Manticore · Volt Typhoon · Whitefly · WIZARD SPIDER
False positives
Requires both 'comsvcs' and the MiniDump export (by name or ordinal

AQL search

skopnix-qradar-ttp-t1003-001-62245b9a.aqldownload .aql ↓
SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE "Process CommandLine" ILIKE '%comsvcs%' AND ("Process CommandLine" ILIKE '%minidump%' OR "Process CommandLine" ILIKE '%#24%')
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: LSASS memory dump via comsvcs.dll MiniDump (T1003.001)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process CommandLine" ILIKE '%comsvcs%' AND ("Process CommandLine" ILIKE '%minidump%' OR "Process CommandLine" ILIKE '%#24%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1003.001".
FP-safety: Requires both 'comsvcs' and the MiniDump export (by name or ordinal

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References