Rule name: "Skopnix: LSASS memory dump via comsvcs.dll MiniDump (T1003.001)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process CommandLine" ILIKE '%comsvcs%' AND ("Process CommandLine" ILIKE '%minidump%' OR "Process CommandLine" ILIKE '%#24%')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1003.001".
FP-safety: Requires both 'comsvcs' and the MiniDump export (by name or ordinal