On a Windows host, an attacker leveraged COMSVCS.DLL via rundll32.exe to dump the memory of svchost.exe into a file under the Temp directory. Review the file creation logs to determine the exact name of the dump file that was generated.

DeviceFileEvents
| where ActionType == "FileCreated"
| where InitiatingProcessFileName =~ "rundll32.exe"
| where InitiatingProcessCommandLine has "comsvcs.dll"
| where FolderPath has "Temp"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FolderPath, FileName, SHA256

DeviceFileEvents
| where InitiatingProcessFileName == 'rundll32.exe' and InitiatingProcessCommandLine contains 'COMSVCS.DLL' and FolderPath contains 'Temp'
| project FileName

DeviceFileEvents
| where ActionType == 'FileCreated'
| extend fileNameLower = tolower(FileName), 
         folderPathLower = tolower(FolderPath), 
         procFileNameLower = tolower(InitiatingProcessFileName), 
         procCmdLineLower = tolower(InitiatingProcessCommandLine)
| where procFileNameLower == 'rundll32.exe'
| where procCmdLineLower has 'comsvcs.dll' and procCmdLineLower has 'svchost'
| where folderPathLower has_any('\\temp', '/temp', '\temp', 'temp')
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine

DeviceFileEvents
| where FolderPath contains "Temp" and InitiatingProcessCommandLine contains "comsvcs.dll" 
| extend DumpFile = FolderPath
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DumpFile, InitiatingProcessCommandLine, DeviceName
| order by LastSeen desc
| extend TimeGenerated = LastSeen

DeviceFileEvents
| where ActionType == "FileCreated"
| where InitiatingProcessFileName == "rundll32.exe"
| where tostring(InitiatingProcessCommandLine) contains "COMSVCS.DLL"
| where FolderPath contains "\\Temp"
| project TimeGenerated, DeviceName, FolderPath, FileName
| order by TimeGenerated desc

DeviceFileEvents
| where FolderPath contains "Temp" and InitiatingProcessFileName == "rundll32.exe" and InitiatingProcessCommandLine contains "COMSVCS.DLL"
| project TimeGenerated, FileName, FolderPath, InitiatingProcessCommandLine

let TempRegex = @"\\Temp(\\|$)";
let rundll = DeviceProcessEvents
| where tolower(FileName) == "rundll32.exe"
| where ProcessCommandLine contains "comsvcs.dll" and ProcessCommandLine contains "MiniDump"
| project DeviceId, DeviceName, Rdl32PID=ProcessId, Rdl32Time=TimeGenerated, Rdl32Cmd=ProcessCommandLine;
union isfuzzy=true
(
    DeviceFileEvents
    | where ActionType in ("FileCreated", "FileCreated (Local)")
    | where tolower(InitiatingProcessFileName) == "rundll32.exe"
    | where InitiatingProcessCommandLine contains "comsvcs.dll" and InitiatingProcessCommandLine contains "MiniDump"
    | where FolderPath matches regex TempRegex
    | extend DumpFilePath = strcat(FolderPath, "\\", FileName)
    | project TimeGenerated, DeviceName, DumpFileName = FileName, DumpFilePath, FileSize, InitiatingProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessId
),
(
    DeviceFileEvents
    | where ActionType in ("FileCreated", "FileCreated (Local)")
    | where FolderPath matches regex TempRegex
    | join kind=innerunique rundll on DeviceId
    | where InitiatingProcessId == Rdl32PID
    | where TimeGenerated between (Rdl32Time .. Rdl32Time + 10m)
    | extend DumpFilePath = strcat(FolderPath, "\\", FileName)
    | project TimeGenerated, DeviceName, DumpFileName = FileName, DumpFilePath, FileSize, InitiatingProcessCommandLine = Rdl32Cmd, InitiatingProcessFolderPath = "", InitiatingProcessId = Rdl32PID
)
| order by TimeGenerated desc

// Find files created by rundll32.exe using COMSVCS.DLL that likely dumped svchost.exe memory into Temp
union isfuzzy=true
(DeviceFileEvents
 | where TimeGenerated between (startofday(ago(7d)) .. now())
 | where InitiatingProcessFileName has_cs "rundll32.exe" or InitiatingProcessFileName has_cs "rundll32"
 | where InitiatingProcessCommandLine has_cs "COMSVCS.DLL" or InitiatingProcessCommandLine has_cs "comsvcs.dll"
 | where FolderPath has_cs "\\Temp" or FileName has_cs "tmp" or FileName has_cs ".dmp" or FileName has_cs ".tmp"
 | project TimeGenerated, DeviceName, FileName, FolderPath, FileSize, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessParentFileName, InitiatingProcessParentId, InitiatingProcessAccountName, AdditionalFields
)
| union (DeviceEvents
 | where TimeGenerated between (startofday(ago(7d)) .. now())
 | where ActionType has_cs "FileCreated" or ActionType has_cs "Created" or Type has_cs "File" or FileName != ""
 | where InitiatingProcessFileName has_cs "rundll32.exe" or InitiatingProcessCommandLine has_cs "COMSVCS.DLL" or ProcessCommandLine has_cs "COMSVCS.DLL"
 | where FolderPath has_cs "\\Temp" or FileName has_cs "tmp" or FileName has_cs ".dmp" or FileName has_cs ".tmp"
 | project TimeGenerated, DeviceName, FileName, FolderPath, FileSize, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessParentFileName, InitiatingProcessParentId, InitiatingProcessAccountName, AdditionalFields
)
| where isnotempty(FileName) and (FileName endswith ".dmp" or FileName endswith ".tmp" or FolderPath has_cs "\\Temp")
| extend FullPath = strcat(FolderPath, "\\", FileName)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Occurrences=count(), any_InitiatingProcessCommandLine=any(InitiatingProcessCommandLine), any_InitiatingProcessFileName=any(InitiatingProcessFileName) by DeviceName, FullPath, FileName, FolderPath, FileSize
| where any_InitiatingProcessCommandLine has_cs "COMSVCS.DLL" or any_InitiatingProcessCommandLine has_cs "comsvcs.dll"
| order by FirstSeen desc
| take 50

// Locate dump file created by rundll32.exe leveraging COMSVCS.DLL against svchost
let initiators = dynamic(["rundll32","rundll32.exe"]);
union DeviceFileEvents, DeviceEvents
| where (tostring(InitiatingProcessFileName) has_any (initiators)
         or (isnotempty(ProcessCommandLine) and ProcessCommandLine contains "rundll32")
         or tostring(FileName) has_any (initiators))
// Ensure the command line / additional fields reference comsvcs.dll
| where (tolower(tostring(InitiatingProcessCommandLine)) contains "comsvcs.dll"
         or (isnotempty(ProcessCommandLine) and tolower(ProcessCommandLine) contains "comsvcs.dll")
         or tostring(AdditionalFields) contains "comsvcs.dll")
// Ensure the command line / additional fields reference svchost
| where (tolower(tostring(InitiatingProcessCommandLine)) contains "svchost"
         or (isnotempty(ProcessCommandLine) and tolower(ProcessCommandLine) contains "svchost")
         or tostring(AdditionalFields) contains "svchost")
// Normalize file/folder fields
| extend DumpFile = tostring(coalesce(FileName, PreviousFileName, "")), FolderPath = tostring(coalesce(FolderPath, ""))
| where isnotempty(DumpFile) or tolower(FolderPath) contains "temp"
// Look for Temp-like locations or common dump extensions
| where tolower(FolderPath) contains "temp"
      or tolower(DumpFile) endswith ".dmp"
      or tolower(DumpFile) endswith ".mdmp"
      or tolower(DumpFile) endswith ".dump"
      or tolower(DumpFile) endswith ".tmp"
      or tolower(DumpFile) endswith ".bin"
// Keep most recent per device+file and show relevant context
| summarize arg_max(TimeGenerated, *) by DeviceId, DumpFile
| where isnotempty(DumpFile)
| project TimeGenerated, DeviceName, DeviceId, DumpFile, FolderPath, FileSize, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, AdditionalFields
| order by TimeGenerated desc

DeviceFileEvents
| where InitiatingProcessFileName contains "rundll32.exe" or InitiatingProcessCommandLine contains "rundll32.exe"
| where InitiatingProcessCommandLine contains "COMSVCS.DLL" or InitiatingProcessFileName contains "COMSVCS.DLL"
| where ActionType in ("CreateFile","FileCreated")
| extend FileNameLower = tolower(FileName), FolderPathLower = tolower(FolderPath)
| where FileNameLower endswith ".dmp" and FolderPathLower contains "temp"
| extend FullPath = strcat(FolderPath, FileName)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, FullPath, FileSize, ReportId

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath contains "Temp"
| where InitiatingProcessFileName == "rundll32.exe"
| where InitiatingProcessCommandLine contains "COMSVCS" or InitiatingProcessCommandLine contains "svchost.exe"
| project Timestamp, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, DeviceName
| order by Timestamp desc

DeviceFileEvents
| where InitiatingProcessFileName =~ 'rundll32.exe'
| where InitiatingProcessCommandLine contains 'comsvcs.dll' and InitiatingProcessCommandLine contains 'MiniDump'
| where FolderPath contains 'Temp'
| project FileName
| distinct FileName

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath contains "Temp"
| where InitiatingProcessFileName == "rundll32.exe"
| where InitiatingProcessCommandLine has "comsvcs.dll"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceFileEvents
| where ActionType == "FileCreated"
| where InitiatingProcessFileName =~ "rundll32.exe"
| where InitiatingProcessCommandLine has "comsvcs.dll"
| where FolderPath contains "Temp"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceFileEvents
| where ActionType startswith "FileCreated"   // file creation events
| where tolower(InitiatingProcessFileName) == "rundll32.exe"
| where tolower(InitiatingProcessCommandLine) has "comsvcs.dll"   // COMSVCS DLL memory dump
| where tolower(FolderPath) contains "\\temp\\"               // written into a Temp directory
// optional: uncomment if you only care about .dmp files
// | where FileName endswith ".dmp"
| project TimeGenerated,
          DeviceName,
          DumpFilePath = strcat(FolderPath, "\\", FileName),
          FileName,
          FileSize,
          SHA256,
          InitiatingProcessCommandLine
| order by TimeGenerated desc
// If multiple entries exist and you only need the latest per host, replace the last line with:
// | summarize arg_max(TimeGenerated, *) by DeviceName

DeviceFileEvents
| where ActionType == "FileCreated"
// Identify rundll32.exe loading COMSVCS.DLL
| where InitiatingProcessFileName == "rundll32.exe"
| where tolower(InitiatingProcessCommandLine) contains "comsvcs.dll"
// Focus on Temp folder
| where tolower(FolderPath) contains "\\temp\\"
// Look only for dump files
| where tolower(FileName) endswith ".dmp"
// Return relevant details
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, FileName, InitiatingProcessCommandLine
| distinct FileName, FolderPath, DeviceName, InitiatingProcessAccountName, TimeGenerated, InitiatingProcessCommandLine