Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

LSASS memory dump via comsvcs.dll MiniDump (T1003.001)

SIGhighconfidence 90/100generated 2026-10-18

A process invokes the MiniDump export of comsvcs.dll (rundll32 comsvcs.dll, MiniDump / Observed for: APT1, APT15, APT27, APT28, APT3, APT32 and 35 more.

ATT&CK
T1003.001 mitre ↗
Linked actors
APT1 · APT15 · APT27 · APT28 · APT3 · APT32 · APT33 · APT35 · APT39 · APT40 · APT5 · Blue Mockingbird · Cleaver · Earth Kapre · Earth Lusca · FIN13 · FIN6 · FIN8 · Fox Kitten · GALLIUM · HAFNIUM · INDRIK SPIDER · Kimsuky · Lazarus Group · Medusa Group · MirrorFace · MuddyWater · OilRig · Pink Sandstorm · PLATINUM · play · RASPITE · SaintBear · Sandworm · Silence group · Tick · UNC3886 · Void Manticore · Volt Typhoon · Whitefly · WIZARD SPIDER
False positives
Requires both 'comsvcs' and the MiniDump export (by name or ordinal

Sigma rule

skopnix-sigma-ttp-t1003-001-73ab7ebb.ymldownload .yml ↓
title: Skopnix - LSASS memory dump via comsvcs.dll MiniDump (T1003.001)
id: ef8cab5c-ea08-515f-bea1-ed138e73a5a0
status: experimental
description: 'A process invokes the MiniDump export of comsvcs.dll (rundll32 comsvcs.dll, MiniDump / Observed for: APT1, APT15, APT27, APT28, APT3, APT32 and 35 more.'
references:
  - https://attack.mitre.org/techniques/T1003/001/
  - https://skopnix.com/actors/apt1
  - https://skopnix.com/actors/apt15
  - https://skopnix.com/actors/apt27
  - https://skopnix.com/actors/apt28
  - https://skopnix.com/actors/apt3
  - https://skopnix.com/actors/apt32
  - https://skopnix.com/actors/apt33
  - https://skopnix.com/actors/apt35
  - https://skopnix.com/actors/apt39
  - https://skopnix.com/actors/apt40
author: skopnix
date: '2026-10-18'
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_dll:
    CommandLine|contains: comsvcs
  selection_export:
    CommandLine|contains:
      - MiniDump
      - '#24'
  condition: all of selection_*
falsepositives:
  - None expected in normal operations; authorised red-team exercises
level: high

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References