Credential Dumping via rundll32 and comsvcs.dll

Adversaries exploit the native Windows comsvcs.dll library to perform memory dumping of the Local Security Authority Subsystem Service (LSASS) process. This technique, commonly executed via rundll32.exe, bypasses traditional file-based detection by using a trusted system binary to interact with the MiniDump API. This activity is frequently observed in post-exploitation scenarios, allowing attackers to harvest plaintext credentials, NTLM hashes, and Kerberos tickets stored in memory. Successfully dumping LSASS memory provides adversaries with the necessary material for lateral movement, privilege escalation, and persistence across a target environment. This technique has been documented in association with various threat actors, including Volt Typhoon, as a core component of living-off-the-land (LotL) strategies. Defenders must focus on identifying the specific command-line arguments and process behaviors associated with the MiniDump export function to mitigate credential theft.

Attack Chain

1. Attacker achieves initial execution on a Windows endpoint using a persistent mechanism or payload.
2. Attacker enumerates active processes to identify the Process ID (PID) of the lsass.exe service.
3. Attacker identifies a requirement to escalate privileges or move laterally, necessitating local credential access.
4. Attacker invokes the native rundll32.exe binary to execute functions within the comsvcs.dll dynamic link library.
5. The command line includes the MiniDump argument and the PID of lsass.exe to generate a memory dump file.
6. Rundll32.exe performs the memory dump operation, writing the contents of LSASS memory to a file on disk (e.g., C:\Windows\Temp\lsass.dmp).
7. Attacker exfiltrates the resulting dump file to an external command-and-control server or secondary internal host.
8. Attacker uses credential-cracking tools (e.g., Mimikatz, Pypykatz) on the dump file to extract plaintext passwords and hashes.

Impact

Successful credential dumping leads to a complete compromise of the affected host's identity secrets. Attackers use these harvested credentials to impersonate users, access domain-joined resources, and perform unauthorized lateral movement. In large environments, this often results in domain-wide privilege escalation and the subsequent deployment of ransomware or long-term data exfiltration.

Recommendation

1. Deploy the Sigma rules below to detect rundll32.exe invocations targeting lsass.exe via comsvcs.dll.
2. Implement endpoint detection and response (EDR) logging for process creation, ensuring capture of the full command line, parent process, and process GUID.
3. Restrict administrative permissions on endpoints to prevent unauthorized users from interacting with high-integrity processes like LSASS.
4. Monitor for the creation of files with the .dmp extension in system directories, which may indicate the successful conclusion of an LSASS dump operation.