Process Memory Dump Via Comsvcs.DLL

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_img": [
    {
      "NewProcessName
| endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine
| contains": "rundll32"
    }
  ],
  "selection_cli_1": {
    "CommandLine
| contains
| all": [
      "comsvcs",
      "full"
    ],
    "CommandLine
| contains": [
      "#-",
      "#+",
      "#24",
      "24 ",
      "MiniDump",
      "#65560"
    ]
  },
  "selection_generic": {
    "CommandLine
| contains
| all": [
      "24",
      "comsvcs",
      "full"
    ],
    "CommandLine
| contains": [
      " #",
      ",#",
      ", #",
      "\"#"
    ]
  },
  "condition": "process_creation and ((selection_img and 1 of selection_cli_*) or selection_generic)"
}

False Positives

• ⚠ Unlikely