Comsvcs.dll MiniDump: Auditing the LOLBin That Dumps LSASS Without Mimikatz

Attackers dump LSASS with a single rundll32 comsvcs.dll call, no malware on disk. Here is how the technique works and how to audit the conditions that make it possible.

Every credential-theft war story starts the same way: someone runs Mimikatz, EDR lights up, and the incident begins. But mature attackers rarely touch Mimikatz on the endpoint anymore. They dump the Local Security Authority Subsystem Service (lsass.exe) process memory to disk with a fully signed, Microsoft-shipped binary, exfiltrate the dump, and parse it offline on their own machine. The most infamous version of this is the comsvcs.dll MiniDump export — one command line, no dropped tooling, and often no antivirus detection at all.

Why LSASS is the prize

LSASS holds the secrets that make single sign-on work: NTLM hashes, Kerberos tickets and keys, and — on poorly hardened hosts — cleartext passwords via WDigest. An attacker who captures LSASS memory from one machine can extract everything needed for pass-the-hash, pass-the-ticket, and lateral movement. Crucially, dumping memory to a file and parsing it elsewhere sidesteps the behavioral detections that fire when a tool actively reads LSASS in place.

The one-line technique

The MiniDump function exported by comsvcs.dll takes a process ID, an output path, and the keyword full. Because it is invoked through rundll32.exe — itself a signed system binary — the whole operation looks like ordinary Windows plumbing:

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> C:\Temp\out.dmp full

Some variants resolve the PID inline and obfuscate the call inside a for loop or a PowerShell wrapper. The output is a standard minidump file that pypykatz, mimikatz sekurlsa::minidump, or a dozen other parsers happily read offline. This maps to MITRE ATT&CK T1003.001 (OS Credential Dumping: LSASS Memory) and the LOLBAS project catalogs comsvcs.dll as a known abuse vector.

What actually has to be true for it to work

The technique is not magic. It depends on a specific set of local conditions, and every one of them is auditable posture — not a live event you have to catch in the moment:

The caller has SeDebugPrivilege / local admin. Reading another process's full memory requires elevated rights. Sprawling local-admin membership is what turns a foothold into a domain-wide credential harvest.
LSASS is not running as a Protected Process Light (PPL). With RunAsPPL enabled, non-PPL callers — including rundll32 — are denied a handle with the access needed to dump memory.
Credential Guard is off. When VBS-backed Credential Guard is active, the juiciest secrets are isolated in an enclave and never sit in dumpable LSASS memory in the first place.
WDigest caches cleartext. If UseLogonCredential is set, the dump yields plaintext passwords, not just hashes.
Defender ASR is not blocking LSASS access. The ASR rule "Block credential stealing from lsass.exe" stops many handle-open attempts outright.

Detection: catch the behavior

If you have Sysmon deployed, the highest-signal detection is Event ID 10 (ProcessAccess) where the target is lsass.exe and the granted access mask includes 0x1010/0x1410 (read + query) from a source like rundll32.exe. Pair that with Event ID 11 (FileCreate) for .dmp files in temp paths, and Windows Security Event 4688 process-creation logs showing comsvcs.dll and MiniDump on the command line (command-line auditing must be enabled). Defender itself flags this as Behavior:Win32/Comsvcs on updated definitions — but definitions and telemetry both assume the endpoint is configured correctly, which is exactly what drifts.

Where WinSentinel fits

Detection tells you the dump already happened. Hardening removes the preconditions so it can't. WinSentinel audits the exact local posture that makes comsvcs.dll MiniDump viable, and it does the full analysis on the machine itself:

Whether LSASS PPL (RunAsPPL) is enabled and surviving reboots.
Whether Credential Guard is running and backed by VBS.
Whether WDigest cleartext caching is disabled.
Whether the relevant Defender ASR rules are in block (not audit) mode.
Local administrator sprawl — who holds the privilege that makes the dump possible at all.
Whether command-line and Sysmon telemetry exist to catch it if prevention fails.

On the free tier this runs at full power on a single machine — all 33 modules, no limits, no feature gating. You get the complete LSASS-hardening picture on any Windows box you point it at. When you're responsible for many machines, Pro adds fleet orchestration: a central node that rolls these findings up across every endpoint, alerts on drift when a host that used to have PPL and Credential Guard enabled quietly regresses, and lets you enforce the hardening baseline from one place instead of logging into a hundred consoles.

The comsvcs.dll dump isn't clever because of what it does — it's clever because everything it touches is signed and expected. You don't beat it by chasing the command line. You beat it by making LSASS unreadable in the first place, and by knowing the moment a machine slips out of that state.

The takeaway

"No Mimikatz on disk" is not "no credential theft." A signed system DLL, one rundll32 invocation, and admin rights are enough to walk away with your whole authentication store. Turn on LSASS PPL and Credential Guard, kill WDigest cleartext, block LSASS access with ASR, shrink local-admin membership, and — most importantly — audit continuously so a single reboot or bad GPO doesn't silently reopen the door.