comsvcs.dll lsass dump

rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <lsass-pid> C:\Windows\Temp\lsass.dmp full

Dump lsass memory using the MiniDump function of comsvcs.dll (signed Windows DLL) via rundll32, without uploading any tool to the host.

When you want to steal lsass credentials without leaving third-party binaries (procdump, mimikatz): rundll32 + comsvcs.dll are Microsoft-signed files. It is the quintessential lsass dump in environments with EDR that allows LOLBAS techniques. You need the lsass PID (typically 672).

If lsass is protected with PPL (LSA Protection/Credential Guard), rundll32 will fail with access denied. Also not if the EDR already correlates the rundll32+comsvcs+MiniDump combination (known signature since 2021): in that case consider procdump or other avenues.