Qilin Mimikatz Credential Dumping

Georg Lauenstein@gsec

•updated Jan 15, 2026•6•2•220

Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.