Mimikatz Kerberos Ticket and Log File Creation
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
Sigma
